uv

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the official installer for the uv tool and Python version configurations from the astral.sh domain and associated GitHub repositories.
  • [REMOTE_CODE_EXECUTION]: Provides documentation for installing the uv tool by piping remote shell and PowerShell scripts directly into the system interpreter. This is the documented and standard installation method for this well-known service.
  • [PERSISTENCE]: Includes instructions to modify shell configuration files such as .bashrc, .zshrc, and completions/uv.fish to enable command-line autocompletion for the uv tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes automation surfaces that process external data files during project initialization and migration.
  • Ingestion points: The init-project.sh script and migration guides in SKILL.md read dependency names from requirements.txt, Pipfile, and other configuration formats.
  • Boundary markers: Absent; the instructions typically assume the input files are well-formed and trusted local project artifacts.
  • Capability inventory: The skill uses uv add, uv sync, and uv run to process the ingested package lists.
  • Sanitization: Employs basic filtering (e.g., grep -v "^#") to exclude comments from requirements files before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 06:11 PM