uv-package-manager

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Three example GitHub URLs point to arbitrary/untrusted user repositories (common vectors for distributing malicious code), so these specific git targets are suspicious while the astral.sh and docs.astral.sh links (official vendor and documentation) are not flagged.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The quick-install commands pipe remote scripts directly to a shell/PowerShell (curl -LsSf https://astral.sh/uv/install.sh | sh and powershell -c "irm https://astral.sh/uv/install.ps1 | iex"), which fetch and execute remote code at runtime, creating a high-risk execution dependency.