python-project-developer
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes boilerplate scripts for project maintenance and distribution, such as
publish.sh, which automates the build and upload process to PyPI. These are standard developer tools and are appropriately scoped to the project's distribution directory.\n- [COMMAND_EXECUTION]: The provided testing templates inrules/testing-guide.mdutilize thesubprocessmodule to verify CLI functionality. This is a common and necessary pattern for integration testing in command-line tools.\n- [DYNAMIC_EXECUTION]: The skill implements adispatchfunction template that uses JSON deserialization and keyword argument unpacking (**arguments) to route tool calls from an LLM to the appropriate API function. This is a standard architectural pattern for function-calling integration.\n- [DYNAMIC_EXECUTION]: The__init__.pytemplates include a lazy loading pattern using__getattr__to defer the import of heavy dependencies liketorchortransformers. This is a recommended performance optimization for CLI tools to ensure fast startup times.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for building tools that process data from LLMs (Ingestion points:dispatchfunction arguments inrules/tools-integration.md). While the templates include basic input validation (Sanitization: check for empty strings), they do not implement strict boundary markers for untrusted content. The resulting projects may have high capabilities (Capability inventory:subprocesscalls in tests, potential file I/O incore.py) which could be exploited if downstream developers do not implement robust sanitization and boundary separation.
Audit Metadata