shunk031-python-uv-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data such as configuration files and source code and uses it to drive command execution via development tools.\n
- Ingestion points: SKILL.md (Workflow steps 7, 8) and references/python-uv-rules.md (Refactoring section) ingest pyproject.toml, uv.lock, and existing source files.\n
- Boundary markers: None present.\n
- Capability inventory: references/python-uv-rules.md and SKILL.md (Workflow step 2) permit execution via uv run, pre-commit, and pytest.\n
- Sanitization: None present.\n- [EXTERNAL_DOWNLOADS]: The skill configuration and templates reference external resources for development tools and quality gates.\n
- Evidence: references/python-uv-rules.md references github.com/pre-commit/pre-commit-hooks and github.com/jendrikseipp/vulture for tool configuration.\n- [COMMAND_EXECUTION]: The workflow requires executing various development tools through the shell.\n
- Evidence: Instructions to use uv run, pre-commit install, and make targets in SKILL.md and references/python-uv-rules.md.
Audit Metadata