python-tooling
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the UV package manager using piped shell execution patterns.
- Fetches the official installer script from Astral's domain for macOS/Linux:
curl -LsSf https://astral.sh/uv/install.sh | sh. - Fetches the official installer script for Windows:
powershell -c "irm https://astral.sh/uv/install.ps1 | iex". - These commands represent the standard, vendor-recommended installation methods for this reputable developer tool.
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of several well-known developer tools and Python packages from official registries and GitHub repositories.
- Tools include
uv,line-profiler,memory-profiler,py-spy, andpytest-benchmark. - Dependencies are fetched from standard sources such as PyPI and official GitHub organizations (
astral-sh,benfred). - [INDIRECT_PROMPT_INJECTION]: The skill instructions define an attack surface for indirect prompt injection common to developer tooling.
- Ingestion points: The skill interacts with project configuration files (
pyproject.toml,uv.lock,requirements.txt) and executes tests/code (uv run,pytest). - Boundary markers: None explicitly defined in the provided snippets.
- Capability inventory: Includes file system access (project initialization), package installation (
uv add), and code execution (uv run,multiprocessing). - Sanitization: Standard tool-level validation is expected when parsing project configuration files.
Audit Metadata