The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to install dependencies, authenticate users, and execute its primary business logic. It interacts with the cargo-ai CLI, npm for package management, and gh for GitHub interactions. It also inspects local configuration files using grep to manage session state.
[EXTERNAL_DOWNLOADS]: The skill installs the @cargo-ai/cli package from the official npm registry. It also provides instructions to fetch additional skill packs from the vendor's GitHub repository using npx skills add.
[DATA_EXFILTRATION]: The skill transmits user-provided email addresses to the Cargo AI platform for verification as part of its core functionality. Additionally, it collects and sends session-level telemetry, including a session ID and usage summary, to the vendor's workspace management API for attribution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external email lists and interpolates them directly into a JSON structure within a shell command argument. This represents an attack surface for potential command injection if malicious data is provided as an email address, as the instructions lack explicit sanitization or boundary markers for the data interpolation.
[PERSISTENCE]: The skill creates a local marker file at ~/.config/cargo-ai/.star-asked to track whether the user has already been prompted to star the repository, allowing this state to persist across multiple sessions.

verify-email-list