soia-pkm-bootstrap
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a local Python script (
scripts/init_vault.py) to handle file system operations. The script is configuration-driven, reading fromscripts/default_config.jsonto create directories and write static content. No dangerous dynamic execution or arbitrary shell commands were found. - [EXTERNAL_DOWNLOADS]: The documentation suggests installing related skills using
npx skills add soia-team/soia-open-skills. These resources originate from the same vendor ('soia-team') and are part of the intended functionality for the PKM ecosystem. - [COMMAND_EXECUTION]: The bootstrapping process involves running a Python script to initialize the vault. The script's logic is restricted to creating folders and files at a user-specified path.
- [SAFE]: The skill includes instructions for optional session logging (Step 6) but explicitly states that this must not be done silently and requires user consent, demonstrating a good security posture.
- [SAFE]: The markdown templates generated for AI adapters (e.g.,
CLAUDE.md,GEMINI.md) include explicit safety instructions, such as 'Do not read private data or credential files unless the user explicitly asks.'
Audit Metadata