soia-env-environment-setup
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill metadata contains deceptive claims regarding its authorship, stating it was created by 'gpt-5' and updated by 'claude-opus-5'. These models do not exist, and such misinformation can lead users to misjudge the skill's source or capabilities.
- [COMMAND_EXECUTION]: The skill documentation includes shell commands for environment setup and plugin management using 'npx skills add' and 'claude plugin' commands to install tools from the soia-team vendor.
- [EXTERNAL_DOWNLOADS]: The skill coordinates the download and installation of multiple external CLI tools and development runtimes from vendor-managed sources.
- [COMMAND_EXECUTION]: The skill flow involves modifications to system environment variables and shell profiles to ensure the persistent availability of installed tools across user sessions.
- [PROMPT_INJECTION]: The skill ingests natural language descriptions of user goals to plan environment setups, creating a surface for potential indirect prompt injection, although the instructions include confirmation steps for critical actions.
Audit Metadata