uv
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official uv installation script from
astral.shand uses official GitHub Actions/Docker images fromastral-sh. - [REMOTE_CODE_EXECUTION]: Recommends the official installation method for the tool, which involves piping a remote script to a shell (
curl | sh). - [COMMAND_EXECUTION]: Executes various shell commands to manage Python projects, including initializing repositories, adding dependencies, and synchronizing environments.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration files such as
requirements.txtandpyproject.tomlto manage dependencies. - Ingestion points: Reads
requirements.txt,pyproject.toml,poetry.lock,Pipfile, andenvironment.ymlto facilitate project migration and management. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Performs file writes (e.g.,
.vscode/settings.json), project initialization (uv init), and dependency installation (uv sync). - Sanitization: Relies on the underlying
uvtool's parsing logic for metadata and dependency resolution. - [PROMPT_INJECTION]: Instructs the agent to automatically configure the IDE Python interpreter path in
.vscode/settings.jsonto maintain environment consistency for the user.
Audit Metadata