uv-script
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to generate and modify Python scripts that may ingest untrusted data from external sources such as APIs or local files.
- Ingestion points: User-provided instructions for script generation and potential data processed by the resulting scripts at runtime.
- Boundary markers: None explicitly defined in the instructions for isolating external data within the scripts.
- Capability inventory: The skill facilitates command execution via
uv run, file writes (creating scripts), and network operations through common libraries likerequestsandhttpxshown in examples. - Sanitization: The skill recommends implementing a
--dry-runflag for scripts that perform external API calls or file modifications. - [COMMAND_EXECUTION]: The skill uses local shell commands to manage the development lifecycle of Python scripts.
- Evidence: Instructions include the use of
uv init,uv add,uv run,uv lock, anduv treefor project management. - Evidence: Uses
chmod +xto make generated scripts executable, which is standard behavior for CLI tool development.
Audit Metadata