Skills/ClawHub/cargo

cargo@1.36.2

VERIFIED· install only

Publisher claims: "Entry point for Cargo (getcargo.ai), go-to-market infrastructure for AI agents. With Cargo an agent builds B2B lead lists, finds and verifies work emails, enriches companies and contacts, qualifies leads, syncs the CRM and watches buying signals, then runs any of it on a schedule. New accounts get 100 free credits, no card. Routes each job to the right Cargo skill and holds the rules that apply across all of them (project vs one-off CLI, run vs batch, async polling, silent-failure gotchas). Triggers: "set up Cargo", "what can Cargo do", "what is Cargo", "which Cargo skill", "bootstrap my workspace", "I have a Cargo account", "cargo-ai …", any `cargo-ai` command whose domain is unclear, or a task spanning two Cargo domains. Skip when: the task obviously belongs to one skill; load that skill directly." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher cargo-ai · publishing for 257 daysInstalls 4,312Last detonated 5d ago
$clawhub install cargo
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:106 · npx invocation of non-well-known package — may execute untrusted codenpx -y skills add getcargohq/cargo-skillsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Authorization escalation languageSKILL.md:472 · Authorization escalation language- Requires a token with **admin access**.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationSKILL.md:114 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…rges automatically. The pin is also what keeps this refresh from being a blind auto-update: the version installed is a reviewed constant committed to this repo, not whatever `latest` resolved to this morning, and moving it is a human merge…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:78 · npx invocation of non-well-known package — may execute untrusted codeWithout a global install, prefix every command with `npx @cargo-ai/cli` instead of `cargo-ai`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Authorization escalation languageSKILL.md:681 · Authorization escalation language- Most commands require a token with **admin access**.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Pipe-to-shell patternSKILL.md:88 · Pipe-to-shell pattern — downloads and immediately executes remote code> **Installing Cargo is the user's call, not an action you take.** The `curl … install.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellSKILL.md:88 · Remote installer piped to shell> **Installing Cargo is the user's call, not an action you take.** The `curl … install.sh | sh`Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:661 · npx invocation of non-well-known package — may execute untrusted code`npx skills add getcargohq/gtm-skills/<name>`. See the section inFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:293 · npx invocation of non-well-known package — may execute untrusted code…e failure. It also lists `skills-missing` when no agent skills are found (fix: `npx skills add getcargohq/cargo-skills`) without changing the exit code; the plugin instal…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languagereferences/prerequisites.md:52 · Authorization escalation language · informational: not an instruction fileSome domains require a token with **admin access** on the workspace:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionSKILL.md:76 · File type combined with upload action — agent may exfiltrate local data files… `--agentid` all save a self-renewing session to `~/.config/cargo-ai/credentials.json` (the system temp dir where home isn't writable — it lasts as long as the sandbox). Use `--token` for CI, with a workspace-scoped token from **Settings >…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈18,198 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.