find-portfolio-companies
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the @cargo-ai/cli package from the NPM registry and references the getcargohq/gtm-skills repository on GitHub. These are legitimate, vendor-owned resources necessary for the skill's lead-generation functionality.
- [COMMAND_EXECUTION]: The skill executes various shell commands to install software, manage authentication (cargo-ai login), and perform data queries. It also includes an instruction for the agent to request explicit user permission before using the GitHub CLI (gh) to star the vendor's repository, ensuring no unauthorized account activity occurs.
- [DATA_EXFILTRATION]: The skill reads the ~/.claude/plugins/installed_plugins.json file to check for existing vendor plugins. This is used for session attribution, where session metadata (id, title, summary) is sent to the Cargo workspace management API. The data transmitted is limited to telemetry and does not include sensitive user content.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it interpolates user-provided investor names directly into SQL query strings for the PeopleDataLabs connector. 1. Ingestion points: User-provided strings in prompts like 'find Sequoia's portfolio companies'. 2. Boundary markers: None present. 3. Capability inventory: Remote database query execution via the cargo-ai CLI. 4. Sanitization: None present in the instructions. This is a low-risk surface inherent to the skill's primary search functionality.
Audit Metadata