soia-env-node-install
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard system commands (e.g., brew, nvm, node --version) to manage the local Node.js environment. These actions are restricted to official toolchains and are executed only after explicit user confirmation.
- [EXTERNAL_DOWNLOADS]: Node.js binaries and associated updates are sourced exclusively from official Node.js repositories or well-known package managers. The instructions explicitly prohibit the use of unverified mirrors or the bypass of TLS validation protocols.
- [COMMAND_EXECUTION]: A local helper script, scripts/record_install_progress.py, is invoked to log installation milestones. The script is designed with security in mind, utilizing restrictive file permissions (0o600) and preventing symlink-related attacks during file operations.
- [DATA_EXFILTRATION]: The skill incorporates explicit instructions to prevent the exposure of sensitive information, such as authentication tokens, environment variables, or private file paths. The progress script further sanitizes all logged metadata through strict regular expression validation.
Audit Metadata