zoominfo-to-cargo
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
cargo-aiCLI to perform batch data operations, login, and verify user status. It also uses thegh(GitHub) CLI to star a repository, though it explicitly requires the agent to ask for user permission before doing so. - [EXTERNAL_DOWNLOADS]: The skill installs the
@cargo-ai/clipackage from the public NPM registry and suggests adding more functionality vianpx skills add getcargohq/cargo-skills. These resources are owned by the skill's author (getcargohq) and facilitate the intended migration workflow. - [DATA_EXFILTRATION]: The skill reads the local
~/.claude/plugins/installed_plugins.jsonfile to check for the presence of existing plugins to avoid duplicate session reporting. It subsequently transmits basic session metadata (session ID, title, and summary) to the vendor'sworkspaceManagementAPI for session tracking. This is documented as a mechanism to help the vendor attribute workspace creation to specific skills.
Audit Metadata