The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the official uv installation script from https://astral.sh/uv/install.sh, which is the well-known domain for the tool's maintainer.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded uv installer script by piping it to the shell (curl | sh).
[COMMAND_EXECUTION]: The agent uses the uv tool to manage the Python environment, sync dependencies, and run various static analysis and testing tools such as ruff, mypy, pyright, and pytest.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests and processes untrusted project files (source code, configuration, markdown) using Read, Grep, and Glob tools. While the agent has powerful capabilities including Bash and Agent execution, the instructions enforce strict objective auditing based only on repository evidence. Mandatory evidence chain: 1. Ingestion points: repository files analyzed via Grep, Read, and Glob. 2. Boundary markers: instructions specify objective reporting based on findings. 3. Capability inventory: includes Bash, Agent, Task, and Edit tools across scripts like env-setup.md and orchestrator.md. 4. Sanitization: No explicit content sanitization logic is described.

python-health-audit