soia-dev-doc-sync
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: No security issues or malicious patterns were identified in the skill instructions. The skill is designed for documentation maintenance using verifiable ground truths from the source code.\n- [EXTERNAL_DOWNLOADS]: The skill documentation describes an installation process using the
npxcommand to run theskillspackage, which fetches components fromsoia-team/soia-open-skills. This is a standard method for installing tools provided by the skill's author.\n- [COMMAND_EXECUTION]: The instructions permit running project-specific validation tools like linters or test suites. These are executed locally to confirm the accuracy of documentation and do not involve unauthorized command execution.\n- [PROMPT_INJECTION]: The skill processes content from external repositories to generate documentation updates, which represents an indirect prompt injection surface.\n - Ingestion points: Reads source code, manifests, and documentation files from the target repository.\n
- Boundary markers: Implements a 'Truth Priority' hierarchy to separate authoritative code facts from derived text.\n
- Capability inventory: Performs local file reads/writes and executes existing project verification tools.\n
- Sanitization: Findings are validated against ground truth code sources, and the skill mandates separate review for critical links and version numbers.
Audit Metadata