soia-dev-skill-release

This module is an orchestration/installer-like tool that does not show overt malicious logic, obfuscation, or data theft within the fragment. However, it substantially increases security risk by (1) executing an external Node CLI via npx using user-influenced repository/skill/agent parameters (runtime supply-chain/code execution boundary), (2) executing a local Python sync script from an installed directory that can be affected by upstream content, and (3) performing filesystem deletions and symlink creation based on skill names that are not explicitly validated for path-safety. Use only with strong trust/allowlisting and controlled provenance for the invoked npx tool, repository sources, and the installed sync script contents.