The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @cargo-ai/cli and @cargo-ai/cdk packages from the npm registry. It also fetches "cookbooks" (worked examples) from the getcargohq/gtm-skills GitHub repository via the cargo-ai cdk add and npx skills add commands. These resources originate from the skill's authoring organization.
[COMMAND_EXECUTION]: The skill requires the execution of the cargo-ai command-line tool to reconcile code definitions with live infrastructure (e.g., cargo-ai cdk deploy, cargo-ai cdk plan). These commands are standard operations for an Infrastructure-as-Code (IaC) tool designed to manage cloud resources.
[INDIRECT_PROMPT_INJECTION]: The skill allows users to define AI agent behaviors, including system prompts and evaluator rubrics, within TypeScript files. While this creates a surface where malicious instructions could be embedded in data (the code), the skill emphasizes version control (cargo.state.json), code review, and manual confirmation (cargo-ai cdk plan) to mitigate risks.
[DYNAMIC_EXECUTION]: The defineWorkflow builder parses JavaScript logic into a node graph for execution on the vendor's platform. It also supports js nodes for custom script execution using a limited set of whitelisted libraries (e.g., axios, lodash, zod). This functionality is a core feature of the workflow engine for processing data.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe secret management by using a secret("ENV_VAR") helper. This ensures that sensitive values like API keys are read from the environment at deploy time and are not stored in the content hash or the state file.

cargo-cdk