modern-python
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known and reputable development tools from their official sources.
- Downloads the 'uv' installer from astral.sh, the official domain for the Astral development team.
- Downloads the 'prek' installer from its official GitHub repository.
- References several pre-commit hooks from reputable organizations and developers on GitHub, including astral-sh, Yelp, and koalaman.
- [COMMAND_EXECUTION]: The skill includes numerous examples of shell commands for project management.
- Uses
uv runto execute Python tools within a managed virtual environment. - Recommends
uvx cookiecutterto bootstrap projects using a template from the author's own GitHub repository (trailofbits). - Provides a Makefile to automate linting, formatting, and testing tasks.
- [DATA_EXFILTRATION]: No sensitive data access or unauthorized exfiltration patterns were detected.
- The skill explicitly recommends security tools like
detect-secretsandzizmorto prevent accidental exposure of credentials or insecure CI configurations. - Includes a Dependabot configuration with a 7-day cooldown period as a defensive measure against supply chain attacks.
Audit Metadata