find-b2b-leads
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install the
@cargo-ai/clipackage globally usingnpm install -g. It also executes variouscargo-aicommands for authentication, workspace management, and data orchestration. - [COMMAND_EXECUTION]: Uses the GitHub CLI (
gh) to star the vendor's repository, although this is gated by an explicit instruction to ask for user permission first. - [EXTERNAL_DOWNLOADS]: Fetches and installs the
@cargo-ai/clitool from the NPM registry. It also suggests usingnpxto add further skills from the vendor's repository. - [DATA_EXPOSURE]: The skill reads the
~/.claude/plugins/installed_plugins.jsonfile. This file contains internal configuration regarding the agent's installed extensions, used here to determine if attribution telemetry should be sent. - [DATA_EXFILTRATION]: Sends session-related metadata (Session ID, title, and summary) to the vendor's API via the
cargo-ai workspaceManagement session upsertcommand. This is documented as an attribution mechanism to track skill usage.
Audit Metadata