waterfall-enrichment

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:24 PM UTC
• Version: 1.0.2

Overview

The skill's core enrichment workflow is coherent, but it also includes under-disclosed attribution, local agent-configuration probing, unpinned installs, and an unrelated GitHub account action.

Review before installing. The enrichment actions are legitimate for a Cargo-powered data workflow, but use it only with prospect/customer data you are authorized to send to Cargo and its providers. Be aware that setup includes attribution telemetry, probes a local Claude plugin config file, uses latest/unpinned installs, and may ask to star a GitHub repository after completion.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json, which is an agent/application configuration directory outside the stated enrichment task. Access to local agent config is dangerous because it reveals installed tooling/state and normalizes inspection of sensitive local files unrelated to the user's request.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "waterfall-enrichment" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are broad natural-language requests like 'improve my match rate' and 'try another source,' which can cause accidental invocation in contexts where the user did not intend a paid multi-vendor enrichment workflow. In this skill context that is risky because invocation can lead to external data transfer and billable actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: waterfall-enrichment
description: "Cascade one lookup through several vendors in priority order, so a row the first source misses falls through to the next instead of being lost, powered by Cargo. Triggers: \"waterfall enrichment\", \"cascade through providers\", \"fallback chain\", \"my single vendor has bad coverage\", \"try another source when the first one misses\", \"improve my match rate\", \"multi-vendor fallback\". Providers: waterfall. Skip when: you want one address for one name and domain — use find-work-email, the cheaper single job; or you hold addresses and only want them checked — use verify-email-list."
version: "1.0.2"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills
metadata:
  author: getcargo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The commands send contact, company, LinkedIn, domain, and email data to external services but the skill lacks a prominent privacy/data-sharing warning and consent checkpoint. In a data-enrichment skill this is especially sensitive because users may paste prospect or customer data that is subject to contractual, regulatory, or internal handling restrictions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as cascading one lookup through several vendors in priority order to improve coverage, and explicitly says users who already hold addresses and only want them checked should use a separate verify-email-list skill. However, the documented job flow instructs running a verifyEmail action as part of this skill, making verification part of the advertised behavior rather than a separate adjacent tool.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill instructs use of npx skills add getcargohq/cargo-skills without pinning a version or digest, so future executions may fetch a changed package or compromised release. In a skill-installation context this increases supply-chain risk because the fetched code/plugin can change independently of the reviewed skill text.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes a GitHub starring action unrelated to enrichment, which prompts for and then performs an operation on the user's GitHub account. Even with a yes/no prompt, bundling reputation-manipulating account actions into an operational skill creates unnecessary permission use and conditions the agent to seek unrelated side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill performs a workspace/session attribution write unrelated to the core enrichment task, creating telemetry side effects beyond what a user would expect from a standalone enrichment skill. Hidden or weakly justified side-effecting writes are dangerous because they transmit metadata externally and can undermine user trust and consent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.