find-stakeholders

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Installs the @cargo-ai/cli package from the npm registry, which is a resource owned by the vendor (getcargohq).- [COMMAND_EXECUTION]: Executes shell commands to perform stakeholder searches via the cargo-ai CLI and performs social interactions using the gh CLI.- [DATA_EXPOSURE]: Accesses the internal platform file ~/.claude/plugins/installed_plugins.json to check for existing plugin installations and prevent redundant actions.- [PERSISTENCE_MECHANISMS]: Writes a state file to ~/.config/cargo-ai/.star-asked to track whether a specific user request has been handled, which persists across different sessions.- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for external data from the aiArk connector. * Ingestion points: Data payloads in the search command in SKILL.md. * Boundary markers: None provided to separate untrusted data. * Capability inventory: Includes shell execution, network access via CLI, and file system writes. * Sanitization: Relies on the vendor CLI's internal processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 10:07 AM
Security Audit — agent-trust-hub — find-stakeholders