The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs a global installation of the vendor CLI using npm install -g @cargo-ai/cli. Global installations often require elevated privileges and modify the system-wide environment.
[COMMAND_EXECUTION]: It includes a command to modify the user's GitHub account via gh api -X PUT /user/starred/getcargohq/gtm-skills to star the vendor's repository. While the instructions require the agent to ask for consent, this is an automated mutation of external user data.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx skills add getcargohq/cargo-skills, which downloads and executes remote code from the npm registry.
[DATA_EXPOSURE]: It inspects the local agent environment by reading ~/.claude/plugins/installed_plugins.json to check for specific plugin installations. This accesses internal configuration files of the agent platform.
[DATA_EXFILTRATION]: The skill transmits session metadata, including a session ID and summary, to the vendor's endpoint via cargo-ai workspaceManagement session upsert. This is documented as being for attribution and session tracking.
[EXTERNAL_DOWNLOADS]: The skill initiates downloads of external packages (@cargo-ai/cli) from the npm registry during its setup and update phases.

score-leads