uv-package-manager
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Provides documentation for installing the uv tool by downloading scripts from the official domain of the software provider, astral.sh.
- [REMOTE_CODE_EXECUTION]: Outlines installation procedures involving piping remote scripts from a well-known software provider directly to shell and PowerShell interpreters.
- [INDIRECT_PROMPT_INJECTION]: The skill describes workflows for processing Python project configuration files and scripts with inline metadata that may be sourced from third parties.
- Ingestion points: Processes dependencies and project settings from pyproject.toml, requirements.txt, and uv.lock files as described in SKILL.md.
- Boundary markers: No specific structural boundary markers are specified for these configuration files within the provided instructions.
- Capability inventory: Offers file system access and system command execution through the uv CLI tool.
- Sanitization: Relies on the uv tool's internal validation mechanisms for project file schemas and dependency resolution.
Audit Metadata