create-gtm-skill
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation references the use of cargo-ai CLI tools and NPM scripts such as
npm run validateandnpm run typecheckas part of the standard development and validation workflow for the repository. - [EXTERNAL_DOWNLOADS]: The skill describes the installation process for customer skills using
npx skills add getcargohq/gtm-skills/<name>. This utilizes the vendor's own distribution mechanism for their platform components. - [INDIRECT_PROMPT_INJECTION]: The authoring guide details how skills should handle external data from sources like CSV files and CRM connectors (HubSpot, Salesforce). To mitigate associated risks, the guide mandates the use of automated validation scripts:
- Ingestion points: CSV files (e.g., webinar-attendees.csv) and CRM data specified in SKILL.md and references/native-models.md.
- Boundary markers: The guide defines structural templates for skills to maintain consistency, though it does not explicitly define prompt-level delimiters.
- Capability inventory: Skills created using this guide utilize
cargo-aiCLI actions for orchestration and data integration. - Sanitization: Automated validation is enforced via
scripts/validate.tsandscripts/check-native-models.mjsto ensure schema and model integrity.
Audit Metadata