skills/upamune/skills/uv-script/Gen Agent Trust Hub

uv-script

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to generate and modify Python scripts that may ingest untrusted data from external sources such as APIs or local files.
  • Ingestion points: User-provided instructions for script generation and potential data processed by the resulting scripts at runtime.
  • Boundary markers: None explicitly defined in the instructions for isolating external data within the scripts.
  • Capability inventory: The skill facilitates command execution via uv run, file writes (creating scripts), and network operations through common libraries like requests and httpx shown in examples.
  • Sanitization: The skill recommends implementing a --dry-run flag for scripts that perform external API calls or file modifications.
  • [COMMAND_EXECUTION]: The skill uses local shell commands to manage the development lifecycle of Python scripts.
  • Evidence: Instructions include the use of uv init, uv add, uv run, uv lock, and uv tree for project management.
  • Evidence: Uses chmod +x to make generated scripts executable, which is standard behavior for CLI tool development.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:50 PM