soia-pkm-bootstrap-vault-base
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes an optional dependency on the
huashu-weread-advisortool, which is installed from a repository belonging to a third-party developer (alchaincyf/huashu-weread). - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the
weread-skillstool from a well-known service's repository (Tencent/WeChatReading). - [COMMAND_EXECUTION]: The skill executes a Python script (
scripts/init_vault.py) to scaffold a knowledge base by creating directories and writing Markdown files locally. - Ingestion points:
scripts/init_vault.pyreads configuration data from user-provided JSON or YAML files through the--configCLI argument. - Boundary markers: The content of files created by the script is taken directly from the configuration file without specific delimiters or instructions to ignore embedded content.
- Capability inventory:
scripts/init_vault.pyperforms file system operations including directory creation (mkdir) and file writing (write_text). - Sanitization: Target paths are processed using
.expanduser().resolve()to normalize directory locations before file operations are performed.
Audit Metadata