uv-package-manager
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references installation scripts hosted on the official astral.sh domain, which is the primary distribution point for the uv tool. This is documented in SKILL.md and references/getting-started.md.
- [REMOTE_CODE_EXECUTION]: The documentation includes standard one-liner installation commands that execute remote scripts via shell piping, such as
curl -LsSf https://astral.sh/uv/install.sh | shandpowershell -c "irm https://astral.sh/uv/install.ps1 | iex". These are the official, recommended installation methods for the tool from its developer.
Audit Metadata