scaffold-python
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a recommendation for the user to install the 'uv' tool using a shell script from 'astral.sh', which is the official domain for Astral's developer tools. This is documented as a reminder for the user rather than an autonomous execution by the agent.
- [REMOTE_CODE_EXECUTION]: Includes the installation pattern 'curl | sh' for the 'uv' tool. Because this targets a well-known and reputable service provider in the Python ecosystem and is presented as a user-facing recommendation, it is considered a legitimate functional component of the skill.
- [COMMAND_EXECUTION]: The skill uses standard local commands for project initialization, including 'uv init', 'uv sync', 'python3 -m venv', and 'pip install' to manage the project environment.
Audit Metadata