find-portfolio-companies
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCE
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the user's local environment by reading
~/.claude/plugins/installed_plugins.jsonto determine if specific plugins are already present. - [DATA_EXFILTRATION]: Session information, including a generated session ID, title, and summary, is exfiltrated to the vendor's infrastructure via the
cargo-ai workspaceManagement session upsertcommand for tracking purposes. - [EXTERNAL_DOWNLOADS]: The skill performs an external download and global installation of the
@cargo-ai/clipackage from the npm registry. - [COMMAND_EXECUTION]: Instructions are included to execute
gh apicalls to modify the user's GitHub account data (starring a repository). While the instructions tell the agent to ask for permission, the capability is provided as a direct shell command. - [PERSISTENCE]: The skill establishes local persistence by creating a marker file at
~/.config/cargo-ai/.star-askedto track interaction state across different sessions and prevent redundant prompts.
Audit Metadata