python-style
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents legitimate development practices including the use of Ruff for linting and formatting, and python-dotenv for local secret management.
- [COMMAND_EXECUTION]: The instructions include the use of the
--break-system-packagesflag withpip installto bypass PEP 668 restrictions on macOS systems managed by Homebrew. While this bypasses a system safeguard designed to protect the OS-managed Python environment from package conflicts, it is presented as a project-specific workflow standard for development workstations and does not involve unauthorized privilege escalation or execution of untrusted remote code. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection via the processing of untrusted project files:
- Ingestion points: The agent reads and modifies
.pyfiles and.envfiles during typical usage. - Boundary markers: No specific delimiters or safety warnings for processing external file content are defined in this skill.
- Capability inventory: The skill utilizes subprocess execution for
pipandruffcommands. - Sanitization: There are no explicit sanitization or filtering steps for data ingested from the project files before it is processed by the agent tools.
Audit Metadata