build-tam-list
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@cargo-ai/clipackage from the public npm registry. This is a vendor-owned resource required for the skill's primary functionality. It also suggests adding further skills vianpx skills add getcargohq/cargo-skills. - [COMMAND_EXECUTION]: The skill executes multiple commands using the
cargo-aiCLI for authentication, session management, and data orchestration. It also utilizes the GitHub CLI (gh) to star the vendor repository, but only after explicit user confirmation. - [PERSISTENCE]: The skill creates a marker file at
~/.config/cargo-ai/.star-askedto track user interaction state, ensuring the user is not repeatedly prompted to star the repository in future sessions. - [COMMAND_EXECUTION]: The skill reads from
~/.claude/plugins/installed_plugins.jsonusinggrepto check for environment configuration and prevent duplicate session creation, which is a standard environment check.
Audit Metadata