python-package-management
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repositories for the uv package manager and poethepoet task runner to facilitate dependency management and task automation.
- [COMMAND_EXECUTION]: The documentation provides standard operational commands for environment setup and package validation, such as
uv run poe setupanduv run poe validate-python-release. - [DYNAMIC_EXECUTION]: The skill describes a lazy-loading pattern using
importlib.import_module. This implementation is safe as it resolves import paths from a predefined, hardcoded dictionary mapping rather than untrusted user input. - [INDIRECT_PROMPT_INJECTION]: The instructions involve updating markdown documentation like
AGENTS.mdandPACKAGE_STATUS.md. Evidence chain: 1) Ingestion: Reads markdown files within the monorepo; 2) Boundary markers: None explicitly defined; 3) Capabilities: Includes subprocess execution via uv and dynamic imports via importlib; 4) Sanitization: Not specified as it assumes a trusted developer/agent context.
Audit Metadata