Add Cargo to Tools & Integrations

[aureeaubert]

Adding Cargo to Community Plugins → Tools & Integrations, per the invitation in getcargohq/cargo-skills#83.

Repository: https://github.com/getcargohq/cargo-skills
Category: Community Plugins → Tools & Integrations (alphabetical, between Canvas Apps Plugin Codex and CarsXE)

What it does

Seventeen agent skills that turn Claude Code, Codex, and Cursor into a go-to-market engineering workstation: build lead lists, find and verify emails and phone numbers, enrich companies and contacts through provider waterfalls, score leads, sync to a CRM, and monitor buying signals (job changes, funding, tech-stack and hiring intent) — plus workspace-as-code via a CDK.

It ships native manifests for three targets from one repo (.claude-plugin/plugin.json, .codex-plugin/plugin.json, and skills.sh), and runs on the @cargo-ai/cli npm package against the Cargo platform.

Verification

Actively maintained — the repo has a lint workflow (skills-lint.yml), routing evals, and a publish pipeline, all green on main; the plugin version is pinned in lockstep with the CLI it documents. The skills load and route in Claude Code and Codex via the bundled plugin manifests.

A note on the CI requirement

CONTRIBUTING.md asks submitters to add hashgraph-online/ai-plugin-scanner-action@v1 to their own repo's GitHub Actions. We don't add third-party actions to that repo's CI — it ships an approval hook and publishes a package, so we keep its workflow surface to things we maintain.

That shouldn't block scoring: the Plugin Trust Scores section notes the HOL Registry already ingests every listed plugin and runs plugin-scanner against it server-side, so the score is produced either way. The repo is public and cloneable if a maintainer wants to run plugin-scanner lint/verify directly. Happy to address any findings it surfaces.

---

🤖 Generated with Claude Code

[aureeaubert]

Renamed the entry from Cargo to Cargo Skills before review.

Reason: in a developer-tool catalog, a bare "Cargo" reads as Rust's package manager. Searching an unrelated 2,281-plugin registry for "cargo" returned only Rust tooling — cargo-deny, Cargo.toml parsing, "npm, pip, Cargo, NuGet" — so the short name would have filed us next to five projects we have nothing to do with. Cargo Skills also matches the repo slug shown right beside it.

Alphabetical position is unchanged (Carg still sorts before Cars).

[zerocodefast]

Adding Cargo to Community Plugins → Tools & Integrations, per the invitation in getcargohq/cargo-skills#83.

Repository: https://github.com/getcargohq/cargo-skills Category: Community Plugins → Tools & Integrations (alphabetical, between Canvas Apps Plugin Codex and CarsXE)

What it does

Seventeen agent skills that turn Claude Code, Codex, and Cursor into a go-to-market engineering workstation: build lead lists, find and verify emails and phone numbers, enrich companies and contacts through provider waterfalls, score leads, sync to a CRM, and monitor buying signals (job changes, funding, tech-stack and hiring intent) — plus workspace-as-code via a CDK.

It ships native manifests for three targets from one repo (.claude-plugin/plugin.json, .codex-plugin/plugin.json, and skills.sh), and runs on the @cargo-ai/cli npm package against the Cargo platform.

Verification

Actively maintained — the repo has a lint workflow (skills-lint.yml), routing evals, and a publish pipeline, all green on main; the plugin version is pinned in lockstep with the CLI it documents. The skills load and route in Claude Code and Codex via the bundled plugin manifests.

A note on the CI requirement

CONTRIBUTING.md asks submitters to add hashgraph-online/ai-plugin-scanner-action@v1 to their own repo's GitHub Actions. We don't add third-party actions to that repo's CI — it ships an approval hook and publishes a package, so we keep its workflow surface to things we maintain.

That shouldn't block scoring: the Plugin Trust Scores section notes the HOL Registry already ingests every listed plugin and runs plugin-scanner against it server-side, so the score is produced either way. The repo is public and cloneable if a maintainer wants to run plugin-scanner lint/verify directly. Happy to address any findings it surfaces.

🤖 Generated with Claude Code

Thanks for the contribution - unfortunately as of now the inclusion of ai-plugin-scanner-action is a hard requirement for submission which helps protect the OSS ecosystem. If you're able to include that, please let us know.

[github-actions]

@aureeaubert — this pull request needs updates before it can be merged.

Contribution requirements failed

Required scanner CI is missing or could not be validated.

• getcargohq/cargo-skills: https://github.com/getcargohq/cargo-skills must invoke hashgraph-online/ai-plugin-scanner-action in .github/workflows

How to fix it

1. Add a workflow under .github/workflows/ in the linked source repository.
2. Trigger it on both push and pull_request, and invoke hashgraph-online/ai-plugin-scanner-action.
3. Configure plugin_dir: ".", mode: scan, min_score: 80, and fail_on_severity: high.

See the repository's contribution requirements and scanner guide.

After pushing the changes, this check and comment will update automatically: https://github.com/hashgraph-online/awesome-ai-plugins/actions/runs/31768441929

[aureeaubert]

Done — the scanner action is now in our CI.

getcargohq/cargo-skills runs .github/workflows/plugin-scanner.yml on push and pull_request, invoking hashgraph-online/ai-plugin-scanner-action with the configuration CONTRIBUTING.md asks for (plugin_dir: ".", mode: scan, min_score: 80, fail_on_severity: high). It's pinned to 55616c96… (v1.2.515) rather than the floating v1 tag, matching what you do in validate-contribution.yml, and the job runs with a read-only GITHUB_TOKEN and no secrets in scope.

Fair point on the requirement, and running it was worth it independently of the listing — the first run came back 71/100 with one critical and one high, so there was something real to fix rather than a formality to satisfy:

• CRITICAL — execSync with a shell string in a QA script helper. Now execFileSync with an argument vector, so no shell parses a command line.
• HIGH — a curl … install.sh literal inline in a skill file. The command now lives only in README.md, where a human runs it; the skill keeps the guidance not to run it on the user's behalf and points there.
• Pinned every uses: across all five workflows to full commit SHAs, and added .github/dependabot.yml so the pins get reviewed rather than going stale.
• Added SECURITY.md (private reporting via the Security tab, plus an explicit boundary between this bundle and the cargo-ai CLI / Cargo platform) and .codexignore.
• Filled in the recommended repository / license / keywords manifest fields and the marketplace category.

Current scan: 92/100 (A), 0 critical, 0 high, 2 medium. The two remaining mediums are documented in our CHANGELOG.md as intentional — a provider slug in a skill description that's correct and CI-synced with the CLI, and a fetch( call in the run-output downloader, which is the point of that function.

The contribution gate re-validates on synchronize or on the daily sweep, so it should pick this up on its own; happy for you to dispatch it sooner if that's easier.

[github-actions]

🎉 Hey @aureeaubert, your plugin has been merged and is now listed in the HOL Registry!

Claim your plugin

As the author, you can verify ownership of your plugin to unlock:

• Owner-verified badge on your plugin's registry listing
• Trust score visibility and analytics for your plugin
• Direct claim link to share with your community
• Dashboard access at hol.org/guard/plugins to track installs, trust, and engagement

How to claim

1. Visit hol.org/guard/plugins
2. Find your plugin and click "Verify ownership"
3. Sign in with GitHub — we only request read:user, user:email, and read:org (no write access to your repos)
4. We verify you own the repository, and your plugin gets the ✅ owner-verified badge

The whole process takes under 30 seconds. No need to add any secrets or tokens to your repo — verification is done entirely through GitHub OAuth.

If you have any questions, feel free to ask here or reach out at support@hol.org.