The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes utilities like 'validate-pyproject', 'migrate-to-uv', and 'build' which are downloaded from PyPI using 'uvx' and 'pip'. These are standard, well-recognized tools in the Python packaging community. The skill specifically advises users to pin versions (e.g., 'migrate-to-uv==0.12.0') to ensure reproducibility and mitigate supply-chain risks.
[COMMAND_EXECUTION]: The skill involves executing 'uv' commands ('uv build', 'uv sync', 'uv lock') and a bundled Python script ('scripts/check_wheel.py'). These commands are necessary for managing project dependencies and verifying the integrity of built artifacts (wheels and sdists).
[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined project configuration files. It mitigates potential injection risks by incorporating strict metadata validation steps using 'validate-pyproject' and providing a dedicated script to verify that only intended files are included in final distribution artifacts.
[SAFE]: The bundled script 'scripts/check_wheel.py' is a read-only utility that performs integrity checks without modifying the environment. The skill's instructions consistently prioritize artifact verification and isolated smoke testing, which are standard security and quality assurance practices.

python-packaging