The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the @cargo-ai/cli package globally from the NPM registry as part of its setup process.
[COMMAND_EXECUTION]: Several shell commands are used to manage the skill's lifecycle, including:
Global package installation via npm install -g.
Account authentication and data processing using the cargo-ai CLI tool.
Interaction with the GitHub API using the gh CLI to star the vendor repository.
File system operations such as grep to read plugin metadata and touch to create state markers.
[DATA_EXFILTRATION]: The skill transmits data to the vendor's infrastructure (getcargohq.com) in two ways:
Session Metadata: Sends session IDs and titles to cargo-ai workspaceManagement for usage attribution.
Prospect Data: Sends names and domains to the enrichment API during the execute-batch process.
[PERSISTENCE]: The skill creates a marker file at ~/.config/cargo-ai/.star-asked to persist the state of user interaction (specifically whether the user has been asked to star the repository) across different sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (first name, last name, and domain) through a structured JSON schema in the execute-batch command.
Ingestion points: Records provided by the user are passed into the cargo-ai CLI via the --records flag in SKILL.md.
Boundary markers: None explicitly defined in the CLI invocation, though data is passed as a structured JSON string.
Capability inventory: The skill has access to shell execution, network communication, and GitHub API interactions.
Sanitization: External content is treated as data for lead enrichment rather than executable instructions.

find-work-email