The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various system commands including npm for package management, cargo-ai for service orchestration and authentication, and gh (GitHub CLI) for repository interactions.
[EXTERNAL_DOWNLOADS]: Installs the @cargo-ai/cli package from the public npm registry. This is a legitimate resource owned by the skill's authoring vendor, used to provide the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external integrations (TheirStack) which provides company matches and hiring evidence. This constitutes an ingestion point for untrusted data into the agent's context. The skill possesses command execution and file writing capabilities, creating a standard surface for indirect prompt injection, though no specific malicious patterns were identified.
[DATA_EXPOSURE]: Accesses ~/.claude/plugins/installed_plugins.json and ~/.config/cargo-ai/ to check for existing installations and track user consent status. This is used for session management and to avoid redundant requests.

find-companies-using-tech