soia-env-qoder-cli-install
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to inspect local installations (e.g.,
npm prefix -g,qodercli --version). These executions are restricted to identifying existing versions and paths, usingshutil.whichfor path resolution before execution. - [EXTERNAL_DOWNLOADS]: The skill fetches version information from well-known registries like
registry.npmjs.org,pypi.org, andapi.github.com. It also performs global installations of the@qoder-ai/qoderclipackage via npm. These are standard operations for a CLI installation manager targeting official vendor packages. - [DATA_EXFILTRATION]: The skill identifies and checks for the existence of configuration files in
~/.qoder. It includes explicit instructions and logic to avoid reading or storing sensitive credentials like tokens, focusing instead on version and status reporting. - [SAFE]: The state management logic in
scripts/record_install_progress.pyfollows best practices for local file storage, including restrictive file permissions and validation of transitions between installation stages.
Audit Metadata