pypi-security-best-practices

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing several well-known developer and security tools.
  • Fetches the uv installation script from Astral's official domain (astral.sh).
  • Fetches the Phylum CLI installer from the official Phylum domain (sh.phylum.io).
  • Fetches the Doppler CLI installer from the official Doppler domain (cli.doppler.com).
  • These downloads target well-known services and are used according to their documented installation procedures.
  • [REMOTE_CODE_EXECUTION]: Includes commands that pipe remote scripts to a shell for execution (curl | sh).
  • This pattern is used exclusively for the installation of reputable third-party tools (uv, Phylum, Doppler).
  • The execution of these scripts is consistent with the skill's primary purpose of teaching users how to set up a secure Python development environment.
  • [COMMAND_EXECUTION]: Contains numerous examples of shell commands for package management, vulnerability scanning, and secret management.
  • All command examples are educational, transparent, and align with industry best practices for security and development workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 08:50 PM
Security Audit — agent-trust-hub — pypi-security-best-practices