The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from untrusted sources such as pyproject.toml, uv.lock, and requirements files. A malicious actor could embed instructions in these files to manipulate the agent's behavior.
Ingestion points: Processes project configuration files (pyproject.toml, uv.toml, uv.lock, .python-version) and dependency lists (referenced in references/projects.md and references/advanced.md).
Boundary markers: The instructions do not define specific delimiters to distinguish between file data and system instructions, although they repeatedly advise the agent to review and verify content.
Capability inventory: The skill leverages capabilities to execute arbitrary code via uv run and install packages via uv tool install and uv pip install (referenced across all reference files).
Sanitization: The skill contains explicit instructions to avoid outputting secrets and to verify the source and content of remote scripts before execution (found in SKILL.md and references/advanced.md).
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading the uv installer from its official domain (astral.sh) and official container registries (ghcr.io/astral-sh/uv). As these are the authoritative sources for the tool being managed, these references are documented as standard behavior.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands and Python scripts through the uv interface. While this is the core intended functionality, it remains an attack surface if the agent is directed by untrusted input to execute specific commands.

uv