python3-core
Fail
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a build hook template (
assets/hatch_build.py) that usessubprocess.runto execute local build scripts. - The implementation follows secure coding practices by using the list/sequence form for commands, explicitly setting
shell=False(default for sequence), and usingshutil.whichto resolve absolute paths for executables likebashandpython3to prevent PATH-based attacks. - [DYNAMIC_EXECUTION]: The
assets/hatch_build.pyfile is designed to dynamically execute scripts found in a project'sscripts/directory at build time. - It searches for
build-binaries.shorbuild-binaries.pyand executes them to facilitate binary compilation before packaging. - [EXTERNAL_DOWNLOADS]: The documentation references several well-known tools and libraries with installation instructions and official links.
- Examples include
uv(Astral),ruff,httpx, andprefect. - An automated alert flagged
python-httpx.orgas phishing; however, this is the verified official documentation domain for the widely usedhttpxlibrary and is a safe resource.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata