modern-python

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known and reputable development tools from their official sources.
  • Downloads the 'uv' installer from astral.sh, the official domain for the Astral development team.
  • Downloads the 'prek' installer from its official GitHub repository.
  • References several pre-commit hooks from reputable organizations and developers on GitHub, including astral-sh, Yelp, and koalaman.
  • [COMMAND_EXECUTION]: The skill includes numerous examples of shell commands for project management.
  • Uses uv run to execute Python tools within a managed virtual environment.
  • Recommends uvx cookiecutter to bootstrap projects using a template from the author's own GitHub repository (trailofbits).
  • Provides a Makefile to automate linting, formatting, and testing tasks.
  • [DATA_EXFILTRATION]: No sensitive data access or unauthorized exfiltration patterns were detected.
  • The skill explicitly recommends security tools like detect-secrets and zizmor to prevent accidental exposure of credentials or insecure CI configurations.
  • Includes a Dependabot configuration with a 7-day cooldown period as a defensive measure against supply chain attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:21 AM
Security Audit — agent-trust-hub — modern-python