The Agent Skills Directory

[SAFE]: The skill follows a secure 'Phase A (Audit) / Phase B (Fix)' workflow, as defined in references/confirmation-gate.md. This ensures no code modifications occur without explicit user confirmation of specific findings and proposed changes.
[COMMAND_EXECUTION]: The script scripts/inventory_codebase.py executes git commands using subprocess.run with a list of arguments (shell=False). The arguments are hardcoded within the script (e.g., rev-parse, branch, status), preventing command injection. This is a standard and safe use of subprocess for project introspection.
[DATA_EXFILTRATION]: The inventory script is designed to be privacy-preserving. It explicitly ignores sensitive directories (e.g., node_modules, .git, venv), only counts potential secrets by name without reading contents, and excludes absolute paths from its output.
[EXTERNAL_DOWNLOADS]: The skill references other components from the same vendor (soia-team) such as soia-dev-fix-loop. These are legitimate vendor dependencies intended for the remediation lifecycle.
[SAFE]: The safe_write function in scripts/inventory_codebase.py uses secure temporary file creation with restricted permissions (0o600) and atomic replacement to prevent race conditions or unauthorized access during file operations.

soia-safe-audit-fix-codebase