monitor-buying-signals
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official
@cargo-ai/clitool from the npm registry to enable its core functionality and downloads additional skill configurations from the vendor's GitHub repository. - [COMMAND_EXECUTION]: Utilizes shell commands to interact with the
cargo-aiCLI for authentication, session management, and intent-monitoring tasks. It also leverages the GitHub CLI (gh) to star the repository, contingent on explicit user approval. - [REMOTE_CODE_EXECUTION]: Employs
npxto dynamically fetch and add additional capabilities from the vendor's central skill repository. - [DATA_EXFILTRATION]: Accesses the local agent configuration file
~/.claude/plugins/installed_plugins.jsonto identify existing plugin installations for attribution purposes and transmits session metadata to the vendor's workspace management API.
Audit Metadata