soia-dev-sync-skills
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a Python script (
sync_soia_skills.py) to manage symbolic links and perform scoped cleanup of retired skills. The instructions also providenpxcommands for installing managed skill packages. - [EXTERNAL_DOWNLOADS]: The documentation references retrieving skills from GitHub and
skillsmp.com. The installation instructions usenpxto fetch thesoia-open-skillspackage from thesoia-teamorganization, which is the author of this skill. These operations are part of the intended management and synchronization workflow. - [DATA_EXPOSURE]: The script interacts with various local AI tool configuration directories (e.g.,
~/.claude/skills,~/.cursor/skills,~/.codex/skills) to create and manage symlinks. It implements a 'dry-run' feature to allow users to review changes before they are applied, and it limits automatic cleanup to symbolic links that match specific vendor-managed naming patterns.
Audit Metadata