python-autotuner
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script for the
uvpackage manager fromhttps://astral.sh/uv/install.sh. This is a standard installation pattern foruv, provided by Astral, a well-known technology provider in the Python ecosystem. - [COMMAND_EXECUTION]: The skill invokes several command-line tools such as
ruff,ty,pytest, andradonthrough shell execution. These tools are used to analyze code quality, verify type safety, run tests, and calculate complexity metrics. - [EXTERNAL_DOWNLOADS]: The skill uses
uvandpipto install dependencies includingruff,ty,pytest,pytest-benchmark, andradon. These are standard packages from official registries used for the skill's operational requirements. - [REMOTE_CODE_EXECUTION]: Employs
importlib.utilto dynamically load and execute the target Python module and its associated benchmark specifications. This capability is essential for generating performance profiles and benchmarking speed improvements usingtimeitandcProfileduring the optimization process. - [PROMPT_INJECTION]: The skill accepts user-provided Python source files for analysis. While this presents an indirect prompt injection surface if a file contains adversarial instructions in comments, the skill's execution flow is strictly defined by technical metric gathering and automated tool execution.
Audit Metadata