black-to-ruff-format
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
uvxto remove the black dependency andpre-committo verify the new configuration. These commands are standard for managing Python project tooling.\n- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the!command`` syntax to runfindcommands at load time. These are used to identify the presence of project configuration files and are benign in nature.\n- [EXTERNAL_DOWNLOADS]: The skill references the officialruff-pre-commitrepository from Astral to configure pre-commit hooks. Astral is a well-known organization in the Python ecosystem, and this download is documented as a standard part of the migration process.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files (pyproject.toml,.pre-commit-config.yaml), which represents an ingestion surface for potentially untrusted data.\n - Ingestion points: The skill reads local configuration files during Step 1 to audit existing settings.\n
- Boundary markers: No delimiters or specific warnings are used when reading these files.\n
- Capability inventory: The skill has permissions to read, write, and edit files, as well as execute commands via
uvxandpre-commit.\n - Sanitization: The skill does not perform explicit sanitization of the configuration data before processing it.
Audit Metadata