find-stakeholders
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
@cargo-ai/clipackage from the npm registry, which is a resource owned by the vendor (getcargohq).- [COMMAND_EXECUTION]: Executes shell commands to perform stakeholder searches via thecargo-aiCLI and performs social interactions using theghCLI.- [DATA_EXPOSURE]: Accesses the internal platform file~/.claude/plugins/installed_plugins.jsonto check for existing plugin installations and prevent redundant actions.- [PERSISTENCE_MECHANISMS]: Writes a state file to~/.config/cargo-ai/.star-askedto track whether a specific user request has been handled, which persists across different sessions.- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for external data from theaiArkconnector. * Ingestion points: Data payloads in the search command in SKILL.md. * Boundary markers: None provided to separate untrusted data. * Capability inventory: Includes shell execution, network access via CLI, and file system writes. * Sanitization: Relies on the vendor CLI's internal processing.
Audit Metadata