engineering-reliability
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/ensure_uv.pyscript downloads an installation script for theuvpackage manager from the official Astral domainhttps://astral.sh/uv/install.sh. - [REMOTE_CODE_EXECUTION]: The skill performs remote code execution by downloading and piping the
uvinstaller to the system shell (sh) using a subprocess call. This is a legitimate bootstrap procedure to ensure the required toolchain is present for the skill's validation scripts. - [COMMAND_EXECUTION]: The bootstrap script
scripts/ensure_uv.pyusessubprocess.runto execute the downloaded shell installer. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided CSV asset files through several Python validator scripts. Ingestion points: Validator scripts in the
scripts/directory read and parse CSV configuration files. Boundary markers: None present. Capability inventory: Subprocess execution is limited to the tool installation script inensure_uv.py. Sanitization: The scripts implement robust validation logic, including regular expression matching for identifiers, type checking for values, and enumeration validation for categories and severities.
Audit Metadata