find-b2b-leads
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@cargo-ai/clipackage globally via npm. This package is the official command-line interface for the skill's author, getcargohq. - [COMMAND_EXECUTION]: The skill uses various shell commands for setup, authentication, and execution, including
npm install,cargo-ai login, andcargo-ai orchestration. These commands are standard for the tool's operational requirements. - [DATA_EXFILTRATION]: The skill sends session attribution metadata (such as session ID and title) to the vendor's infrastructure using the
cargo-ai workspaceManagement session upsertcommand. This is documented behavior for session tracking within the vendor's ecosystem. - [COMMAND_EXECUTION]: The skill includes instructions to star the vendor's repository using the
ghAPI. Importantly, it mandates that the agent must obtain explicit user consent before executing this command and checks for a local marker file (~/.config/cargo-ai/.star-asked) to avoid repeated requests.
Audit Metadata