apollo-to-cargo
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
@cargo-ai/clitool to perform business operations including account login, data enrichment, and email verification. These are legitimate uses of the vendor's CLI for the stated purpose of the skill. - [COMMAND_EXECUTION]: The skill interacts with the local file system to check for existing plugins (
~/.claude/plugins/installed_plugins.json) and to store a marker indicating if a GitHub star was requested (~/.config/cargo-ai/.star-asked). These are standard persistence patterns for configuration and session management. - [EXTERNAL_DOWNLOADS]: The skill installs its core dependency
@cargo-ai/clifrom the official NPM registry, which is an expected installation path for this tool. - [SAFE]: The skill uses the GitHub CLI (
gh) to star the vendor's repository only upon explicit user confirmation, checking a local config file to ensure the user is not asked multiple times.
Audit Metadata