find-b2b-leads

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to install the @cargo-ai/cli package globally using npm install -g. It also executes various cargo-ai commands for authentication, workspace management, and data orchestration.
  • [COMMAND_EXECUTION]: Uses the GitHub CLI (gh) to star the vendor's repository, although this is gated by an explicit instruction to ask for user permission first.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the @cargo-ai/cli tool from the NPM registry. It also suggests using npx to add further skills from the vendor's repository.
  • [DATA_EXPOSURE]: The skill reads the ~/.claude/plugins/installed_plugins.json file. This file contains internal configuration regarding the agent's installed extensions, used here to determine if attribution telemetry should be sent.
  • [DATA_EXFILTRATION]: Sends session-related metadata (Session ID, title, and summary) to the vendor's API via the cargo-ai workspaceManagement session upsert command. This is documented as an attribution mechanism to track skill usage.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 10:06 AM
Security Audit — agent-trust-hub — find-b2b-leads