python-scripting

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes references to the official installation method for the 'uv' package manager via the command curl -LsSf https://astral.sh/uv/install.sh | sh. This targets the well-known technology provider Astral and is the legitimate, recommended procedure for installing the tool mentioned in the skill.
  • [PROMPT_INJECTION]: The skill generates Python templates intended for processing external data, which inherently establishes a surface for indirect prompt injection. 1. Ingestion points: The template references/uv-script.template.py implements argument parsing for an 'input' file path. 2. Boundary markers: No specific delimiters or safety instructions are included in the boilerplate to isolate processed content. 3. Capability inventory: The generated scripts possess file system read and write capabilities as part of their intended utility. 4. Sanitization: No sanitization or validation logic is provided in the generated boilerplate. This represents a standard characteristic of command-line data processing tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 02:49 AM
Security Audit — agent-trust-hub — python-scripting