uv-package-manager
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches installation scripts and binaries from the official astral.sh domain and associated GitHub repositories for the uv project. These are well-known resources from the tool's vendor.
- [REMOTE_CODE_EXECUTION]: The instructions describe how to install the uv tool by piping remote scripts to shell or PowerShell interpreters. This is the documented and official installation process provided by the vendor.
- [PROMPT_INJECTION]: Analysis of indirect prompt injection surfaces shows that the tool processes project configuration files such as requirements.txt and pyproject.toml. Ingestion points: File reading from the local workspace. Capability inventory: Dependency resolution, network access to package registries, and file system modifications. Sanitization: Handled by the uv tool's internal validation mechanisms.
Audit Metadata