zoominfo-to-cargo

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:30 PM UTC
• Version: 1.0.2

Overview

The skill’s main Cargo comparison workflow is coherent, but it also includes under-disclosed telemetry, local agent-config probing, a GitHub account action, and persistent local marker state that are not needed for the stated task.

Review before installing. The core enrichment workflow may be useful, but expect business contact/company data to be sent to Cargo and its providers, and avoid running the optional attribution, GitHub star, or unpinned follow-on install commands unless you explicitly want those side effects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 94% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json to inspect the agent's local configuration state. Accessing agent config directories is sensitive because it can reveal installed tools, environment details, and other local metadata unrelated to the business task, and it establishes a precedent for local reconnaissance by skill content.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "zoominfo-to-cargo" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill's compatibility/setup requires signing into or creating a persistent external account, which introduces session persistence beyond the immediate task. In this context, persistence matters because subsequent commands can operate under a stored authenticated session, potentially causing future data transmission or billing without fresh user awareness.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: zoominfo-to-cargo
description: "Rebuild a ZoomInfo list on Cargo and measure the coverage you actually lose or gain before the renewal, powered by Cargo. Triggers: \"ZoomInfo alternative\", \"migrate off ZoomInfo\", \"replace ZoomInfo\", \"our ZoomInfo renewal is coming up\", \"ZoomInfo is too expensive\", \"I have a ZoomInfo export\", \"cheaper than ZoomInfo\", \"Lusha alternative\", \"Cognism alternative\". Providers: waterfall. Skip when: you are porting a Clay table rather than a contact list — use clay-to-cargo; or you have no list yet and simply want contacts sourced — use find-b2b-leads."
version: "1.0.2"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills
metadata:
  author: getcargo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs the user to create/log into an account and run networked enrichment and verification operations before giving a prominent privacy and data-transmission warning. Because the task involves uploading contact/company identifiers and verification targets, users may transmit sensitive business data to an external service without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This block performs session/workspace attribution writes that are not necessary to rebuild or compare a ZoomInfo sample. Unrelated telemetry or metadata writes expand data exposure and can transmit identifiers such as session IDs, titles, and summaries to a third-party service without being essential to the user task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs use of npx skills add getcargohq/cargo-skills without pinning an exact package/version. That allows execution of whatever version is currently published or resolved at runtime, creating a supply-chain risk if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The repository-starring workflow is unrelated to the stated migration/comparison task and asks the agent to take an action using the user's GitHub account. Even with a prompt for consent, embedding this in the skill broadens the scope of authorized actions and creates pressure to perform nonessential account operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs use of gh api -X PUT /user/starred/..., which exercises GitHub account capabilities unrelated to list rebuilding or data coverage measurement. This is dangerous because it normalizes privileged actions on third-party accounts inside a workflow that does not require them, increasing the chance of account misuse or unintended side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The command creates ~/.config/cargo-ai/.star-asked, adding persistent local state unrelated to the core ZoomInfo-to-Cargo comparison. Even though the file is small, it modifies the user's environment for a nonessential purpose and establishes hidden cross-session behavior inside a business workflow.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Static analysis

No suspicious patterns detected.