uv-package-manager
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and standard usage patterns for the
uvPython package manager, which is a legitimate and widely used tool in the Python ecosystem. - [SAFE]: All referenced external integration points, including Docker images (ghcr.io/astral-sh/uv) and GitHub Actions (astral-sh/setup-uv), originate from the official maintainers' repositories and domains.
- [SAFE]: The documentation explicitly promotes security best practices, such as using lockfiles for reproducibility, pinning specific Python versions, and advising the user to inspect project configurations and build hooks before installation.
- [SAFE]: No malicious patterns, such as prompt injection, obfuscation, unauthorized data exfiltration, or suspicious command execution, were found in the provided files.
Audit Metadata