uv

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the official uv installation script from astral.sh and uses official GitHub Actions/Docker images from astral-sh.
  • [REMOTE_CODE_EXECUTION]: Recommends the official installation method for the tool, which involves piping a remote script to a shell (curl | sh).
  • [COMMAND_EXECUTION]: Executes various shell commands to manage Python projects, including initializing repositories, adding dependencies, and synchronizing environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration files such as requirements.txt and pyproject.toml to manage dependencies.
  • Ingestion points: Reads requirements.txt, pyproject.toml, poetry.lock, Pipfile, and environment.yml to facilitate project migration and management.
  • Boundary markers: None explicitly defined in the instructions.
  • Capability inventory: Performs file writes (e.g., .vscode/settings.json), project initialization (uv init), and dependency installation (uv sync).
  • Sanitization: Relies on the underlying uv tool's parsing logic for metadata and dependency resolution.
  • [PROMPT_INJECTION]: Instructs the agent to automatically configure the IDE Python interpreter path in .vscode/settings.json to maintain environment consistency for the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:23 PM