uv
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions for executing shell commands, scripts, and CLI tools within isolated project environments using
uv run,uvx, anduv tool. This is the core functionality of the management tool. - [EXTERNAL_DOWNLOADS]: Facilitates fetching and installing Python packages and CLI tools from remote registries like PyPI and Astral's repositories using
uv addanduv tool install. These operations target well-known and trusted service providers. - [DATA_EXFILTRATION]: Documents the
uv publishcommand, which is used to transmit package distributions to external indexes like PyPI as part of the normal software release cycle. - [PROMPT_INJECTION]: The skill manages project configuration files such as
pyproject.tomland scripts with inline metadata, representing a surface for indirect prompt injection. 1. Ingestion points: Reads project configuration and script metadata. 2. Boundary markers: Not specified in the current instructions. 3. Capability inventory: Command execution viauv runand network access viauv addanduv publish. 4. Sanitization: Relies on the underlying tool's processing of structured data and scripts. - [SAFE]: All external references and repositories point to the official documentation and verified source code of Astral, a reputable developer tool provider.
Audit Metadata