skills/dashed/claude-marketplace/uv/Gen Agent Trust Hub

uv

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documents the official standalone installer for the uv tool, which involves fetching a script from https://astral.sh/uv/install.sh and piping it directly to the shell. This is an expected and standard installation method provided by the tool vendor.
  • [EXTERNAL_DOWNLOADS]: The skill references downloads from the official Astral domain (astral.sh) for both Unix-like and Windows installation scripts, as well as managed Python interpreters from Astral's GitHub-hosted infrastructure.
  • [COMMAND_EXECUTION]: The skill enables the agent to execute a variety of commands for Python project management, including initializing projects, adding dependencies, and running scripts within virtual environments.
  • [INDIRECT_PROMPT_INJECTION]: The nature of the tool requires processing project configuration files and Python scripts which could potentially contain embedded instructions.
  • Ingestion points: User-provided Python scripts, pyproject.toml, and uv.lock files.
  • Boundary markers: No specific boundary markers or warnings are used to instruct the agent to ignore instructions within the project files.
  • Capability inventory: The agent can perform package installation, tool management, and arbitrary script execution via uv run.
  • Sanitization: No sanitization is performed on the content of external project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 12:00 PM
Security Audit — agent-trust-hub — uv