soia-dev-plan-release-checklist
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's documentation provides an installation command (
npx skills add) that fetches a package from thesoia-teamrepository. This is a vendor-owned resource used for skill deployment. - [COMMAND_EXECUTION]: The skill references a local configuration directory (
~/.config/soia-skills/) for optional user-defined defaults. It does not perform unauthorized file system modifications or execute arbitrary shell commands. - [DATA_EXFILTRATION]: The instructions contain strict requirements to mask or exclude sensitive data such as API keys, tokens, and internal production addresses, replacing them with placeholders like
<已提供的敏感值>. - [PROMPT_INJECTION]: The workflow emphasizes that missing information must be marked as 'pending confirmation' rather than being hallucinated, reducing the risk of the agent generating unsafe or incorrect operational instructions based on ambiguous input.
Audit Metadata