uv
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official installer for the uv tool and Python version configurations from the astral.sh domain and associated GitHub repositories.
- [REMOTE_CODE_EXECUTION]: Provides documentation for installing the uv tool by piping remote shell and PowerShell scripts directly into the system interpreter. This is the documented and standard installation method for this well-known service.
- [PERSISTENCE]: Includes instructions to modify shell configuration files such as
.bashrc,.zshrc, andcompletions/uv.fishto enable command-line autocompletion for the uv tool. - [INDIRECT_PROMPT_INJECTION]: The skill includes automation surfaces that process external data files during project initialization and migration.
- Ingestion points: The
init-project.shscript and migration guides inSKILL.mdread dependency names fromrequirements.txt,Pipfile, and other configuration formats. - Boundary markers: Absent; the instructions typically assume the input files are well-formed and trusted local project artifacts.
- Capability inventory: The skill uses
uv add,uv sync, anduv runto process the ingested package lists. - Sanitization: Employs basic filtering (e.g.,
grep -v "^#") to exclude comments from requirements files before processing.
Audit Metadata