The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the @cargo-ai/cli package from the official npm registry and references project recipes from the getcargohq GitHub organization.
[COMMAND_EXECUTION]: Utilizes the cargo-ai CLI for authenticating users, managing workspaces, and performing batch enrichment of company data.
[COMMAND_EXECUTION]: Uses the gh CLI to interact with the GitHub API for starring a repository; this action is strictly gated by a requirement for explicit user consent and the presence of a local marker file to prevent redundant requests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests company domains provided by the user in Step 2 for enrichment. While it lacks explicit boundary markers for this external data, the risk is minimal as the data is used as input for structured enrichment via the vendor's CLI.
Ingestion points: Company domain records passed to cargo-ai orchestration action execute-batch in SKILL.md.
Boundary markers: Absent for the lead data input.
Capability inventory: Shell command execution (cargo-ai, gh, npm), file system read/write (~/.claude/plugins/installed_plugins.json, ~/.config/cargo-ai/.star-asked), and network operations via CLI tools.
Sanitization: Input sanitization is managed by the vendor's CLI tool when processing batch records.
[DATA_EXPOSURE]: Accesses environment-specific configuration files including ~/.claude/plugins/installed_plugins.json to detect existing plugins and ~/.config/cargo-ai/.star-asked to track user preferences.

score-leads