python-project-developer

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes boilerplate scripts for project maintenance and distribution, such as publish.sh, which automates the build and upload process to PyPI. These are standard developer tools and are appropriately scoped to the project's distribution directory.\n- [COMMAND_EXECUTION]: The provided testing templates in rules/testing-guide.md utilize the subprocess module to verify CLI functionality. This is a common and necessary pattern for integration testing in command-line tools.\n- [DYNAMIC_EXECUTION]: The skill implements a dispatch function template that uses JSON deserialization and keyword argument unpacking (**arguments) to route tool calls from an LLM to the appropriate API function. This is a standard architectural pattern for function-calling integration.\n- [DYNAMIC_EXECUTION]: The __init__.py templates include a lazy loading pattern using __getattr__ to defer the import of heavy dependencies like torch or transformers. This is a recommended performance optimization for CLI tools to ensure fast startup times.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for building tools that process data from LLMs (Ingestion points: dispatch function arguments in rules/tools-integration.md). While the templates include basic input validation (Sanitization: check for empty strings), they do not implement strict boundary markers for untrusted content. The resulting projects may have high capabilities (Capability inventory: subprocess calls in tests, potential file I/O in core.py) which could be exploited if downstream developers do not implement robust sanitization and boundary separation.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 07:09 PM