python-development-python-scaffold
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and instructs the execution of shell commands such as
uv init,git init, anddjango-admin startproject. These are standard tools for project initialization and are used appropriately within the defined scope of project scaffolding. - [EXTERNAL_DOWNLOADS]: The skill references standard development libraries (e.g., FastAPI, Django, Pydantic, Ruff) to be installed via
uv. These packages are sourced from official, well-known registries and represent a safe dependency chain for the intended project types. - [INDIRECT_PROMPT_INJECTION]: The skill uses a requirements section to tailor the project structure to user needs, creating an attack surface for indirect prompt injection.
- Ingestion points: User-defined project requirements enter the skill via the
$ARGUMENTSvariable inSKILL.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious embedded content within the user requirements.
- Capability inventory: The skill has the capability to write various files (source code, configuration, Makefiles) and execute shell commands for project setup.
- Sanitization: The skill relies on the agent's default safety filters and does not implement additional validation or escaping for the input data.
Audit Metadata