clay-to-cargo

SUSPICIOUS. The core Cargo CLI usage is coherent with the claimed Clay-to-Cargo migration purpose and uses same-vendor official distribution, so this is not malware. Risk comes from secondary behaviors: telemetry/session stamping, optional GitHub starring, paid autonomous API actions, and especially transitive installation of another skill bundle, which expands trust beyond the standalone migration task.