The Agent Skills Directory

[SAFE]: The skill provides comprehensive documentation and templates for engineering standards. It emphasizes data ownership, idempotency, and backward compatibility, which are defensive security best practices.
[COMMAND_EXECUTION]: The skill includes Python scripts (scripts/ensure_uv.py, scripts/documentation/doc_impact.py, etc.) used for validating project assets and checking documentation impact. These scripts use subprocess.run to execute commands like sh and git. These are scoped to local project metadata and environment setup.
[EXTERNAL_DOWNLOADS]: The file scripts/ensure_uv.py downloads a shell script from https://astral.sh/uv/install.sh and pipes it to sh. This is a standard installation method for the uv tool, which is a high-performance Python package manager developed by Astral. Astral is a well-known entity in the Python ecosystem, and this behavior is documented as the primary way to bootstrap the required environment for the skill's validation scripts. Under [TRUST-SCOPE-RULE], this is treated as safe as it targets a well-known developer service and does not involve sensitive data access.
[SAFE]: Automated scan alerts regarding urllib.request.urlopen and subprocess.run in scripts/ensure_uv.py were evaluated. The logic is confirmed to be a standard installer for the uv tool. The script is used solely to prepare the Python environment for the skill's utility scripts and does not exhibit malicious behavior.

engineering-architecture