The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts and project metadata from the official domains and repositories of the tool's developers (astral.sh and github.com/astral-sh).
[REMOTE_CODE_EXECUTION]: Provides instructions for the standard installation of the uv tool, which involves downloading a remote script and piping it to a shell (e.g., curl -LsSf https://astral.sh/uv/install.sh | sh). While this pattern is often associated with remote code execution, in this context it refers to the primary, official installation method for the documented tool.
[COMMAND_EXECUTION]: Includes numerous examples of command-line operations for creating virtual environments, installing dependencies, and running scripts via the uv CLI, which are fundamental to the tool's purpose.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting untrusted data through project configuration files like requirements.txt and pyproject.toml, as well as installing packages directly from remote Git URLs.
Ingestion points: Reads and processes requirements.txt, pyproject.toml, and external Git repository URLs.
Boundary markers: Not present (documentation of CLI tool usage).
Capability inventory: Includes file system writes, network access for package fetching, and arbitrary command execution via uv run.
Sanitization: None (standard for documentation of a package manager tool).

uv-package-manager