python-typing-ops

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/check-types.sh executes shell commands to run mypy and pyright. These executions are restricted to specific, well-known development tools and take target paths as arguments. This is standard functionality for a development-oriented skill.
  • [EXTERNAL_DOWNLOADS]: The skill documentation and configuration files (references/mypy-config.md, assets/pyproject-typing.toml) recommend installing official type stubs and libraries (e.g., types-requests, types-redis, pydantic, beartype) from standard registries like PyPI using uv. These are well-known, trusted resources for Python development.
  • [INDIRECT_PROMPT_INJECTION]: As a development tool, the skill is designed to process codebases.
  • Ingestion points: The check-types.sh script and type checker commands in SKILL.md ingest source code files for analysis.
  • Boundary markers: None explicitly defined in the provided scripts, as these are standard command-line tools.
  • Capability inventory: The skill has Read and Write tool permissions and executes local shell commands via the provided script.
  • Sanitization: The script performs basic target path validation but otherwise relies on the underlying type checking tools (mypy, pyright) to handle file content safely. This represents a standard surface for indirect prompt injection common to developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 04:07 PM