The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands to inspect project structure (ls, grep, find), manage environment states (uv sync, uv lock), and perform builds (uv build). These are standard operations for development tools.
[EXTERNAL_DOWNLOADS]: The skill uses uvx to download and run packaging utilities from the Python Package Index (PyPI). These downloads are pinned to specific versions to mitigate supply-chain risks. Evidence: uvx migrate-to-uv==0.12.0 in SKILL.md and uvx --from validate-pyproject[all]==0.25 validate-pyproject in SKILL.md.
[REMOTE_CODE_EXECUTION]: External tools fetched via uvx are executed in the local environment to facilitate project migrations and metadata validation.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and acting upon untrusted data found in local project configuration files and build artifacts.
Ingestion points: The skill analyzes local files such as pyproject.toml, setup.py, poetry.lock, and requirements.txt in SKILL.md, and inspects built wheels and sdists using the scripts/check_wheel.py script.
Boundary markers: Absent; the instructions direct the agent to treat information found within project files as authoritative for project configuration.
Capability inventory: The skill can execute shell commands, manage project dependencies, and run Python scripts (check_wheel.py) based on its analysis of the project files.
Sanitization: The skill incorporates validate-pyproject in SKILL.md to verify that pyproject.toml metadata follows valid schemas, which provides a layer of validation for the project configuration.

python-packaging