Skills
Navigate
skills/practicalswan/agent-skills/hf-cloud-python-env-setup/Gen Agent Trust Hub

hf-cloud-python-env-setup

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/setup_env.py script uses subprocess.run to manage virtual environments and install packages. These operations are restricted to standard development tools and are necessary for the skill's stated purpose.
  • Evidence: Multiple calls to subprocess.run in scripts/setup_env.py for executing uv, venv, and pip commands.
  • [EXTERNAL_DOWNLOADS]: The skill installs necessary dependencies from standard registries. The packages are well-known libraries for interacting with AWS services.
  • Evidence: The skill automates the installation of boto3 and awscli from the official Python Package Index (PyPI) via pip.
  • [INDIRECT_PROMPT_INJECTION]: The environment setup and version check scripts accept command-line arguments that could potentially be influenced by external data in an automated pipeline. The scripts include basic validation to mitigate accidental misconfiguration.
  • Ingestion points: sys.argv usage in scripts/setup_env.py and scripts/check_versions.py to accept directory names, version strings, and package names.
  • Boundary markers: Not present.
  • Capability inventory: Command execution via subprocess.run and directory removal via shutil.rmtree in scripts/setup_env.py.
  • Sanitization: The parse_version function in scripts/setup_env.py validates the Python version string format and enforces a supported range (3.10-3.12).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:52 AM
Security Audit — agent-trust-hub — hf-cloud-python-env-setup