track-job-changes
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
@cargo-ai/clipackage from the NPM registry to enable local interaction with the vendor's orchestration services. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage user sessions, execute data enrichment batches via the
cargo-aiutility, and optionally interact with the GitHub CLI (gh) to star the repository. - [DATA_EXFILTRATION]: The skill reads the user's plugin configuration file at
~/.claude/plugins/installed_plugins.jsonto prevent duplicate session tracking and sends basic session metadata (session ID, title, and summary) to the vendor's workspace management API for attribution. - [REMOTE_CODE_EXECUTION]: The instructions suggest expanding capabilities by using
npx skills addto fetch additional skill definitions from the vendor's official GitHub repository.
Audit Metadata