python-typing-ops
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check-types.shexecutes shell commands to runmypyandpyright. These executions are restricted to specific, well-known development tools and take target paths as arguments. This is standard functionality for a development-oriented skill. - [EXTERNAL_DOWNLOADS]: The skill documentation and configuration files (
references/mypy-config.md,assets/pyproject-typing.toml) recommend installing official type stubs and libraries (e.g.,types-requests,types-redis,pydantic,beartype) from standard registries like PyPI usinguv. These are well-known, trusted resources for Python development. - [INDIRECT_PROMPT_INJECTION]: As a development tool, the skill is designed to process codebases.
- Ingestion points: The
check-types.shscript and type checker commands inSKILL.mdingest source code files for analysis. - Boundary markers: None explicitly defined in the provided scripts, as these are standard command-line tools.
- Capability inventory: The skill has
ReadandWritetool permissions and executes local shell commands via the provided script. - Sanitization: The script performs basic target path validation but otherwise relies on the underlying type checking tools (
mypy,pyright) to handle file content safely. This represents a standard surface for indirect prompt injection common to developer tools.
Audit Metadata