build-pyproject

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes build commands using ./pw (the pyprojectx wrapper) or pwx. These executions are restricted to predefined subcommands (e.g., compile, verify, quality-gate) and are standard for the Python development lifecycle.
  • [DATA_EXPOSURE]: The skill reads pyproject.toml and standard test directories (test/, tests/) for module discovery and metadata extraction. This access is localized to the project environment and is consistent with its role as a build system extension.
  • [REMOTE_CODE_EXECUTION]: Execution is limited to local wrappers and system fallbacks. There are no patterns of piping remote content to a shell or downloading executable scripts from external URLs.
  • [SAFE]: The 'self-heal' mechanism in _pyproject_execute.py renames the .pyprojectx cache directory to .pyprojectx.broken if specific uv or virtualenv corruption symptoms are detected. This is a localized recovery operation and does not pose a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:12 AM
Security Audit — agent-trust-hub — build-pyproject