pypi-security-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing several well-known developer and security tools.
- Fetches the
uvinstallation script from Astral's official domain (astral.sh). - Fetches the Phylum CLI installer from the official Phylum domain (
sh.phylum.io). - Fetches the Doppler CLI installer from the official Doppler domain (
cli.doppler.com). - These downloads target well-known services and are used according to their documented installation procedures.
- [REMOTE_CODE_EXECUTION]: Includes commands that pipe remote scripts to a shell for execution (
curl | sh). - This pattern is used exclusively for the installation of reputable third-party tools (uv, Phylum, Doppler).
- The execution of these scripts is consistent with the skill's primary purpose of teaching users how to set up a secure Python development environment.
- [COMMAND_EXECUTION]: Contains numerous examples of shell commands for package management, vulnerability scanning, and secret management.
- All command examples are educational, transparent, and align with industry best practices for security and development workflows.
Audit Metadata