build-pyproject
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes build commands using
./pw(the pyprojectx wrapper) orpwx. These executions are restricted to predefined subcommands (e.g., compile, verify, quality-gate) and are standard for the Python development lifecycle. - [DATA_EXPOSURE]: The skill reads
pyproject.tomland standard test directories (test/,tests/) for module discovery and metadata extraction. This access is localized to the project environment and is consistent with its role as a build system extension. - [REMOTE_CODE_EXECUTION]: Execution is limited to local wrappers and system fallbacks. There are no patterns of piping remote content to a shell or downloading executable scripts from external URLs.
- [SAFE]: The 'self-heal' mechanism in
_pyproject_execute.pyrenames the.pyprojectxcache directory to.pyprojectx.brokenif specificuvor virtualenv corruption symptoms are detected. This is a localized recovery operation and does not pose a security risk.
Audit Metadata