The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the @cargo-ai/cli package from the npm registry to provide the necessary command-line tools. This is an official package maintained by the skill's author (getcargohq).
[COMMAND_EXECUTION]: The skill executes various shell commands to facilitate the workflow, including npm install for setup, cargo-ai for authentication and email processing, and gh api for GitHub interactions. It also uses npx to suggest the installation of additional verified skill sets from the same vendor.
[DATA_EXFILTRATION]: Usage metadata, including a session ID and skill identifier, is sent to the vendor's workspace management API via the cargo-ai tool to track and attribute session activity. Additionally, user-provided email addresses are transmitted to the waterfall service for deliverability verification as part of the primary skill function.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of email lists. While this represents a potential surface for indirect prompt injection, the risk is minimal given the specific expected data format and the tool's intended utility.

verify-email-list