create-pdf-fixture
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'uv' tool from its official, well-known domain (astral.sh) if not present on the system. This is a standard practice for the development environment defined in the skill.
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()andbashscripts to orchestrate local Python files and project-specific tools. These operations are scoped to the skill's primary purpose of generating PDF fixtures. - [REMOTE_CODE_EXECUTION]: The file
run.shcontains a fallback command to install the 'uv' package manager:curl -LsSf https://astral.sh/uv/install.sh | sh. As Astral is a well-known service for Python tooling, this is documented as a neutral finding. - [SAFE]: The skill references an external repository
https://github.com/grahama1970/extractor.git. Since 'grahama1970' is the author of this skill, this is recognized as a legitimate vendor resource.
Audit Metadata