The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading the uv binary and installer scripts from Astral's official domains.
Evidence: Fetches the standalone installer from https://astral.sh/uv/getting-started/installation/ and pinned releases from https://astral.sh/uv/0.12.21/install.sh.
Evidence: Pulls the official Docker image from ghcr.io/astral-sh/uv.
Note: These resources originate from a well-known technology vendor (Astral) and are documented neutrally for installation purposes.
[COMMAND_EXECUTION]: The skill describes how to execute the uv CLI tool to manage Python environments and run scripts.
Evidence: Instructions include running subcommands like uv run, uv sync, and uv tool install which modify the local filesystem and manage subprocesses.
Evidence: Usage of chmod +x to make Python scripts executable as standalone tools.
[INDIRECT_PROMPT_INJECTION]: The skill documents features that ingest and process external data, such as requirements files and scripts with inline metadata.
Ingestion points: The uv add -r requirements.txt command reads external dependency files into the project context.
Boundary markers: The skill does not define specific prompt delimiters for file content, but the tool itself operates on structured file formats.
Capability inventory: The skill has capabilities for network operations (downloading packages), file system writes (creating virtual environments), and subprocess execution (uv run).
Sanitization: Not explicitly present in the instructions, but the skill includes a 'Supply chain' warning advising users to review dependency lists from untrusted sources before execution.
[CREDENTIALS_SAFE]: The skill follows security best practices for handling sensitive information.
Evidence: Explicitly instructs users to use environment variables (UV_INDEX_INTERNAL_USERNAME, etc.) for private package index credentials and provides a warning to 'Never commit them'.

uv