CI: run the HOL AI plugin scanner (#102)

* CI: run the HOL AI plugin scanner hashgraph-online/awesome-ai-plugins requires every listed plugin's source repo to invoke `ai-plugin-scanner-action` on push/pull_request before the listing PR can merge (getcargohq/cargo-skills#83 → their PR #72). Pinned to a full commit SHA instead of the floating `v1` tag, with a read-only token and no secrets in scope, so a third-party action in our workflow surface can't reach anything it shouldn't. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: publish the scanner report when the scan fails The action's built-in summary step is `if: success()`, so a failing scan prints counts and no findings. Render markdown to a file and cat it into the step summary unconditionally. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: tee the scanner report to the job log as well Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: clear the plugin scanner's 80-point / no-high gate The scanner job this PR added failed on its first run: 71/100 against a `min_score` of 80, one critical finding and one high. The awesome-ai-plugins contribution gate re-scans this repo with the same two thresholds, so the findings had to be fixed rather than configured around. Now 92/100 (A), zero critical, zero high. - Pin every `uses:` in .github/workflows/ to a full commit SHA, and add .github/dependabot.yml so the pins move weekly instead of never. - Add SECURITY.md: private reporting via the Security tab, and an explicit boundary between this bundle and the cargo-ai CLI / Cargo platform. - Stop inlining `curl … install.sh` in cargo/SKILL.md. The command now lives only in README.md, where a human runs it; the router keeps the guidance (never run it on the user's behalf) and points there. - Use execFileSync, not execSync, for `npm root -g` in the QA script library — no shell to interpret a command string. Windows gets the npm.cmd shim. - Fill in repository/license/keywords in .codex-plugin/plugin.json, a category on the .agents marketplace entry, and add .codexignore. - Set write_step_summary: false on the scanner action and publish the report ourselves, so it lands once whether the gate passes or fails. Two medium findings are left standing and documented in CHANGELOG.md: the `anthropic` provider slug in cargo-gtm's description (correct, and CI-synced with the CLI) and `fetch(` in the run-output downloader (the point of the function). Neither is a gate failure. Co-Authored-By: Auree Aubert <16732193+aureeaubert@users.noreply.github.com> Co-Authored-By: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com> Co-authored-by: Auree Aubert <16732193+aureeaubert@users.noreply.github.com>
2026-09-14 19:17:15 +08:00 · 2026-08-14 19:00:18 -07:00
parent 8b36982db4
commit 6683645b00
18 changed files with 184 additions and 27 deletions
@@ -6,6 +6,7 @@
    {
      "name": "cargo",
      "source": { "source": "local", "path": "./" },
+      "category": "Sales & Marketing",
      "description": "17 skills over the cargo-ai CLI — build target account and contact lists, enrich and verify them against licensed data providers, score and qualify leads, sync your CRM, monitor buying signals, run workflows, and manage the whole workspace as code.",
      "policy": { "installation": "AVAILABLE", "authentication": "ON_INSTALL" }
    }
@@ -2,7 +2,7 @@
  "name": "cargo",
  "displayName": "Cargo",
  "description": "Build with Cargo in Claude Code — 17 skills over the cargo-ai CLI (target lists, contact enrichment and verification from licensed data providers, lead scoring, CRM sync, signal monitoring, orchestration, storage, segments, CDK, diagnostics) plus prompt-free approval for safe cargo-ai calls.",
-  "version": "1.20.0",
+  "version": "1.20.1",
  "author": { "name": "getcargo" },
  "homepage": "https://github.com/getcargohq/cargo-skills",
  "skills": ["./"],
@@ -1,9 +1,12 @@
 {
  "name": "cargo",
  "description": "Build with Cargo in Codex — 17 skills over the cargo-ai CLI (target lists, contact enrichment and verification from licensed data providers, lead scoring, CRM sync, signal monitoring, orchestration, storage, segments, CDK, diagnostics) plus prompt-free approval for safe cargo-ai calls.",
-  "version": "1.20.0",
+  "version": "1.20.1",
  "author": { "name": "getcargo" },
  "homepage": "https://github.com/getcargohq/cargo-skills",
+  "repository": "https://github.com/getcargohq/cargo-skills",
+  "license": "MIT",
+  "keywords": ["cargo", "gtm", "revenue", "enrichment", "orchestration", "cli"],
  "skills": "./",
  "hooks": "./hooks/codex-hooks.json",
  "interface": {
@@ -0,0 +1,14 @@
+# Paths that are part of this repository but not part of the skill bundle a
+# Codex install should carry. Keeping them out shrinks what an agent loads and
+# what a packager ships.
+
+# Repo tooling and CI — not skill content.
+.github/
+evals/
+
+# Build output from .github/scripts/build-codex-package.mjs.
+dist/
+
+# Local editor / OS noise.
+.DS_Store
+node_modules/
@@ -1,7 +1,7 @@
 {
  "name": "cargo",
  "description": "Build with Cargo in Cursor — 17 skills over the cargo-ai CLI (target lists, contact enrichment and verification from licensed data providers, lead scoring, CRM sync, signal monitoring, orchestration, storage, segments, CDK, diagnostics) plus prompt-free approval for safe cargo-ai calls.",
-  "version": "1.20.0",
+  "version": "1.20.1",
  "author": { "name": "getcargo" },
  "homepage": "https://github.com/getcargohq/cargo-skills",
  "logo": "assets/logo.svg",
@@ -0,0 +1,16 @@
+version: 2
+
+# The bundle ships no dependency manifest — the skills are markdown and the two
+# runnable surfaces (hooks/*.sh, cargo-gtm/scripts/*.ts) use only the shell and
+# the Node standard library. That leaves GitHub Actions as the one dependency
+# surface worth watching, and now that every `uses:` is pinned to a commit SHA,
+# Dependabot is what moves those pins.
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "CI"
+    labels:
+      - "dependencies"
@@ -22,9 +22,9 @@ jobs:
    env:
      CLAWHUB_OWNER: cargo-ai
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"

@@ -30,9 +30,9 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"

@@ -57,7 +57,7 @@ jobs:
      - name: Build and validate the package
        run: node .github/scripts/build-codex-package.mjs

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: cargo-skills-codex
          path: dist/cargo-skills-codex.zip
@@ -70,7 +70,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: cargo-skills-codex

@@ -0,0 +1,44 @@
+name: plugin-scanner
+
+# Required by hashgraph-online/awesome-ai-plugins for a listing (their
+# `validate-contribution.py` gate checks that this repo runs the scanner on
+# push/pull_request). The action is pinned to a full commit SHA rather than the
+# floating `v1` tag, and the job gets a read-only token with no secrets in
+# scope — the same shape the awesome-ai-plugins maintainers use themselves.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan the plugin bundle for security and quality signals
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Run HOL AI Plugin Scanner
+        uses: hashgraph-online/ai-plugin-scanner-action@55616c962cf86368423f7673b2ecdfdbe613d1af # v1.2.515
+        with:
+          plugin_dir: "."
+          mode: scan
+          format: markdown
+          output: scanner-report.md
+          min_score: 80
+          fail_on_severity: high
+          # No `pull-requests: write` above, so the comment would fail anyway.
+          pr_comment: off
+          # The action publishes the report itself, but that step is skipped
+          # when the scan exits non-zero — exactly when the findings matter.
+          # Turn it off and own the publishing below, so the report lands the
+          # same way whether the gate passes or fails.
+          write_step_summary: false
+
+      - name: Publish scanner report
+        if: always()
+        run: tee -a "$GITHUB_STEP_SUMMARY" < scanner-report.md || true
@@ -41,9 +41,9 @@ jobs:
    # A missing key (forks, or before the secret is set) should skip, not fail.
    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

@@ -14,9 +14,9 @@ jobs:
    name: Validate SKILL.md frontmatter, JSON snippets, internal links
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"

@@ -27,10 +27,10 @@ jobs:
    name: Run QA script fixture suites
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      # Node >= 22.18: the QA scripts are .ts run via native type-stripping.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

@@ -64,9 +64,9 @@ jobs:
    name: Route prompts to the right skill
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

@@ -10,6 +10,19 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/

 ## [Unreleased]

+### `cargo` → 1.20.1 (router), `cargo-gtm` → 1.14.1 — clearing the plugin scanner's gate
+
+The listing PR at `hashgraph-online/awesome-ai-plugins#72` requires this repo to run [`hashgraph-online/ai-plugin-scanner-action`](https://github.com/hashgraph-online/ai-plugin-scanner-action) on push and pull request, and their contribution gate re-scans the repo with the same thresholds — `min_score: 80`, `fail_on_severity: high`. The first run scored **71/100** with one critical and one high finding, so the gate was failing on substance rather than on wiring. This is the substance. The bundle now scores **92/100 (A)** with zero critical and zero high findings.
+
+- **Every `uses:` in `.github/workflows/` is pinned to a full commit SHA** with the version in a trailing comment, and new [`.github/dependabot.yml`](.github/dependabot.yml) watches the `github-actions` ecosystem weekly so the pins move on a schedule instead of never. GitHub Actions is the repo's only real dependency surface — the skills are markdown and the runnable files use only the shell and the Node standard library.
+- **New [`SECURITY.md`](SECURITY.md)** — private vulnerability reporting through the repo's Security tab, an explicit in-scope/out-of-scope boundary (this bundle, not the `cargo-ai` CLI or the Cargo platform), and the hardening the repo already applies. A skill bundle installs straight into an agent, so "open a public issue" is the wrong default for a report about it.
+- **The router no longer inlines the `curl … install.sh` bootstrap.** The scanner flags any `curl <url>` inside a `SKILL.md` as a risky skill instruction, and it is right to: a skill file is an instruction an agent may act on, and the one thing this paragraph has always said is that the agent must *not* run that installer itself. The guidance is unchanged and slightly sharper — the command now lives only in [`README.md`](README.md), where a human runs it.
+- **`cargo-gtm/scripts/lib/common.ts` uses `execFileSync` instead of `execSync`** for its one subprocess call (`npm root -g`). Same behavior, no shell to interpret a command string, and it clears the scanner's only critical finding. Windows gets the `npm.cmd` shim by name, since without a shell there is nothing to resolve it.
+- **Manifest and marketplace metadata filled in** — `repository`, `license`, and `keywords` in [`.codex-plugin/plugin.json`](.codex-plugin/plugin.json) (the root [`plugin.json`](plugin.json) already carried them), a `category` on the [`.agents/plugins/marketplace.json`](.agents/plugins/marketplace.json) entry, and a new [`.codexignore`](.codexignore) keeping repo tooling out of what a Codex install carries.
+- **`plugin-scanner.yml` sets `write_step_summary: false`** and publishes the report itself. The action's own summary step is skipped when the scan exits non-zero — exactly when the report matters — so owning it means the report lands identically whether the gate passes or fails, instead of being printed twice on success and not at all on failure.
+
+Two medium findings are left standing on purpose. `SOCIAL_ENG_ANTHROPIC_IMPERSONATION` fires on the literal string `anthropic` in `cargo-gtm`'s provider list, which is a Cargo integration slug that [`sync-trigger-slugs.ts`](.github/scripts/sync-trigger-slugs.ts) keeps in sync with the CLI — the name is correct and dropping it would make the description wrong. `DATA_EXFIL_JS_NETWORK` fires on `fetch(` in the QA script that downloads a run's outputs from a signed URL, which is the whole point of the function. Neither is a gate failure; both cost the same 8-point Cisco check, so neither is worth contorting the code for.
+
 ### `cargo-orchestration` → 1.7.0, `cargo` → 1.20.0 (router), `cargo-diagnostics` → 1.2.0, `cargo-cdk` → 1.2.2 — draw the workflow

 Nothing in the bundle told an agent to show a node graph as a picture. The only nudge was one line in `interaction.md` — "a compact node-flow sketch or table beats prose" — which left the format to the model, so the plan gate asked users to approve a graph they had to reconstruct from prose. Meanwhile every surface these skills print into (Claude Code, GitHub, the Cargo docs) renders Mermaid.
@@ -0,0 +1,60 @@
+# Security policy
+
+## What this repository ships
+
+`cargo-skills` is a bundle of agent skills: markdown instructions, plus a small
+number of runnable files — the approval and session hooks under `hooks/`, the QA
+helper scripts under `cargo-gtm/scripts/`, and the CI scripts under
+`.github/scripts/`. It contains no server, no service, and no credentials. It
+talks to Cargo only by telling an agent to invoke the separately-installed
+[`@cargo-ai/cli`](https://www.npmjs.com/package/@cargo-ai/cli).
+
+That shape sets the boundary for what belongs here:
+
+- **In scope** — anything in this repository that could make an agent take an
+  action its user did not authorize: an approval-hook bypass in `hooks/`, a
+  command-injection or path-traversal bug in a runnable script, a skill
+  instruction that leaks credentials or workspace data, a supply-chain weakness
+  in the CI workflows, or a tampered/typosquatted release of this bundle.
+- **Out of scope** — vulnerabilities in the `cargo-ai` CLI itself, in the Cargo
+  platform or its API, or in the third-party data providers the skills call.
+  Report those to Cargo directly rather than here; a report filed here about the
+  platform will be forwarded, which only slows it down.
+
+## Reporting a vulnerability
+
+Use GitHub's private vulnerability reporting: open the
+[Security tab](https://github.com/getcargohq/cargo-skills/security/advisories/new)
+of this repository and file a draft advisory. That channel is private to the
+maintainers until an advisory is published.
+
+**Please do not open a public issue or pull request for a security report** —
+this repository is installed directly by agents, so a public report is a
+disclosed exploit for every install at once.
+
+A useful report includes the affected file and version (see
+[`CHANGELOG.md`](CHANGELOG.md) and the `version` field in `cargo/SKILL.md`), what
+an attacker can cause an agent to do, and the smallest reproduction you have.
+
+You can expect an acknowledgement within three business days and an assessment
+with a fix or mitigation plan within ten.
+
+## Supported versions
+
+Only the latest published version of the bundle is supported. Fixes ship as a
+new version rather than as patches to older ones — agents install from the
+default branch or from the latest release, so "upgrade" is always the remedy.
+
+## Hardening this repository already applies
+
+- Every `uses:` in `.github/workflows/` is pinned to a full commit SHA, and
+  Dependabot moves those pins (`.github/dependabot.yml`).
+- CI jobs default to a read-only `GITHUB_TOKEN` (`permissions: contents: read`);
+  only the release-attach job is granted `contents: write`.
+- The plugin bundle is scanned on every push and pull request by
+  `.github/workflows/plugin-scanner.yml`.
+- The approval hook (`hooks/approve-cli.sh`) auto-approves only a plain
+  `cargo-ai` invocation, and never one that chains, redirects, or substitutes
+  another program. Login/logout, token minting, report egress, and
+  `cdk deploy`/`destroy` are gated back to the normal approval prompt, as is any
+  invocation carrying a destructive verb.
@@ -1,7 +1,7 @@
 ---
 name: cargo-gtm
 description: "Do business-to-business go-to-market work on Cargo — research accounts and buying committees, enrich and verify B2B contact records from licensed data providers, score and qualify leads, draft permission-based outreach for the user's own sequencer, sync to CRM, and monitor buying signals. Consent basis, suppression lists, and volume limits gate every step that touches a person (`references/acceptable-use.md`); bulk unsolicited messaging, purchased or scraped lists, and consumer targeting are refused. Triggers: \"build me a list of\", \"find 50 <title> at <segment>\", \"who works at\", \"find work emails for these accounts\", \"enrich this CSV\", \"verify these emails\", \"build a TAM\", \"who fits our ICP\", \"who actually buys from us\", \"what data points should we collect on accounts\", \"our outbound is reaching the wrong people\", \"score these leads\", \"write a first-touch email\", \"push these to my CRM\", \"who changed jobs\", \"who just raised funding\", \"companies using <tech>\", \"who is hiring <role>\", \"find the buying committee\", \"portfolio companies of <investor>\", \"upload this audience to Google/Meta/LinkedIn ads\". Providers: aiArk, anthropic, apolloio, bouncer, cargo, cleon1, companyEnrich, contactOut, datagma, dropcontact, enrichCrm, enrichley, enrowio, findyMail, firecrawl, forager, FullEnrich, g2, gemini, hunter, icypeas, kitt, leadMagic, linkedin, linkup, mixrank, neverBounce, oceanio, openAi, peopleDataLabs, perplexity, piloterr, prospeo, reverseContact, rocketreach, salesNavigator, serper, snitcher, societeInfo, theirStack, theSwarm, waterfall, zeroBounce. Reads phase guides, recipes, and per-provider playbooks before any paid call. Skip when: a run already happened and misbehaved — use cargo-diagnostics."
-version: "1.14.0"
+version: "1.14.1"
 compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
 homepage: https://github.com/getcargohq/cargo-skills
 metadata:
@@ -8,7 +8,7 @@
 import { readFileSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";

 export type Row = Record<string, string>;
@@ -181,7 +181,13 @@ async function loadCargoApi(): Promise<{ buildApi: (deps: object) => any }> {
    // Not resolvable from here — try the global npm root (the CLI itself is
    // installed globally, so this is the common case for a global install).
    try {
-      const globalRoot = execSync("npm root -g", { encoding: "utf8" }).trim();
+      // execFileSync, not execSync: the argument vector goes to npm directly
+      // instead of through a shell, so there is no command string to interpret.
+      // Windows needs the .cmd shim by name, since there is no shell to find it.
+      const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+      const globalRoot = execFileSync(npm, ["root", "-g"], {
+        encoding: "utf8",
+      }).trim();
      const requireFromGlobal = createRequire(join(globalRoot, "noop.js"));
      const entry = requireFromGlobal.resolve("@cargo-ai/api");
      return (await import(entry)) as any;
@@ -1,7 +1,7 @@
 {
  "$comment": "Generated by .github/scripts/skills-metadata.mjs — do not hand-edit. Regenerate with: node .github/scripts/skills-metadata.mjs --write .",
  "name": "cargo-gtm",
-  "version": "1.14.0",
+  "version": "1.14.1",
  "documents": [
    {
      "path": "SKILL.md",
@@ -498,5 +498,5 @@
      "kind": "script"
    }
  ],
-  "contentHash": "3f52243dca75d8d16329c03370d29e2d88b2fb7e5d1a8dda2202e5e141a2728c"
+  "contentHash": "25742583271a50b08ed92c97bc48da4ab0d818d60a8a5eef2c82a7c364ed52fe"
 }
@@ -1,7 +1,7 @@
 ---
 name: cargo
 description: "Router for the Cargo CLI skill bundle — load first for anything Cargo, and whenever a task spans two Cargo domains. Explains what each skill owns, declarative workspace-as-code (cargo-cdk) vs the imperative CLI, the UUID and slug flow between skills, async polling of runs and batches, end-to-end use cases, and the gotchas that fail silently (`conjonction` spelling, run vs batch, model-uuid vs segment-uuid). Triggers: \"set up Cargo\", \"what can Cargo do\", \"which Cargo skill\", \"bootstrap my workspace\", \"I have a Cargo account\", \"cargo-ai …\", or any `cargo-ai` command whose domain you are unsure of. Skip when: the task obviously belongs to one skill — load that skill directly."
-version: "1.20.0"
+version: "1.20.1"
 compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
 homepage: https://github.com/getcargohq/cargo-skills
 metadata:
@@ -76,9 +76,9 @@ All commands output JSON to stdout. Failed commands exit non-zero and return `{"

 ## Every Cargo session has three jobs

-> **Automated on Claude Code.** Jobs 1 and 3 (refresh + session register/finalize) run on their own when either the **Cargo plugin** is installed (its bundled `SessionStart`/`Stop`/`SessionEnd` hooks handle them) or the installer's hooks (`curl -fsSL https://api.getcargo.io/install.sh | sh`) are present. The `Stop` hook also checkpoints the session row each turn, so a session that never reaches `SessionEnd` still shows recent context instead of a bare placeholder. Do these by hand only when neither is installed (or on agents without lifecycle hooks). Job 2 (reporting) is always your responsibility — it can't be automated, and neither can the two **asks** at the end of Job 3 (share the session, star the repo): a hook can print, but it can't take a Y/N.
+> **Automated on Claude Code.** Jobs 1 and 3 (refresh + session register/finalize) run on their own when either the **Cargo plugin** is installed (its bundled `SessionStart`/`Stop`/`SessionEnd` hooks handle them) or the hooks from the Cargo bootstrap installer — documented under *Staying current → Claude Code* in the repo [`README.md`](../README.md) — are present. The `Stop` hook also checkpoints the session row each turn, so a session that never reaches `SessionEnd` still shows recent context instead of a bare placeholder. Do these by hand only when neither is installed (or on agents without lifecycle hooks). Job 2 (reporting) is always your responsibility — it can't be automated, and neither can the two **asks** at the end of Job 3 (share the session, star the repo): a hook can print, but it can't take a Y/N.
 >
-> **Never run that installer on the user's behalf without asking.** It pipes a network-fetched script into a shell. If they want to inspect it first, have them download once and run that file — `curl -fsSL https://api.getcargo.io/install.sh -o cargo-install.sh`, read it, then `sh cargo-install.sh` — rather than fetching twice, which proves nothing about what executes.
+> **Never run that installer on the user's behalf without asking.** Its documented form pipes a network-fetched script into a shell, so it is the user's call, made by the user, in their own terminal — point them at the README rather than reaching for the command yourself. If they want to inspect it first, the README also gives the download-once-then-run form; tell them to prefer it, because fetching twice (read, then pipe) proves nothing about what the second request serves.

 ### 1. At session start — refresh and register

@@ -1,7 +1,7 @@
 {
  "$comment": "Generated by .github/scripts/skills-metadata.mjs — do not hand-edit. Regenerate with: node .github/scripts/skills-metadata.mjs --write .",
  "name": "cargo",
-  "version": "1.20.0",
+  "version": "1.20.1",
  "documents": [
    {
      "path": "SKILL.md",
@@ -43,5 +43,5 @@
      "title": "UUID flow between skills"
    }
  ],
-  "contentHash": "716a830447db66ea638b35be7389609bdf194c47c92de3b43c8bbbe36482dad8"
+  "contentHash": "537f7432c610298c90cc7401cd39fb53701850d3f7c5f532645f438a0e95b2a8"
 }