python3-core

Fail

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a build hook template (assets/hatch_build.py) that uses subprocess.run to execute local build scripts.
  • The implementation follows secure coding practices by using the list/sequence form for commands, explicitly setting shell=False (default for sequence), and using shutil.which to resolve absolute paths for executables like bash and python3 to prevent PATH-based attacks.
  • [DYNAMIC_EXECUTION]: The assets/hatch_build.py file is designed to dynamically execute scripts found in a project's scripts/ directory at build time.
  • It searches for build-binaries.sh or build-binaries.py and executes them to facilitate binary compilation before packaging.
  • [EXTERNAL_DOWNLOADS]: The documentation references several well-known tools and libraries with installation instructions and official links.
  • Examples include uv (Astral), ruff, httpx, and prefect.
  • An automated alert flagged python-httpx.org as phishing; however, this is the verified official documentation domain for the widely used httpx library and is a safe resource.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 3, 2026, 10:28 AM