uv-package-manager
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'uv' installer and related files from 'astral.sh' and 'github.com/astral-sh'. These are the official sources for the 'uv' tool and are considered well-known/trusted for this context.
- [REMOTE_CODE_EXECUTION]: The skill includes documentation for installing 'uv' via shell-piped scripts (e.g.,
curl -LsSf https://astral.sh/uv/install.sh | sh). While this is a sensitive pattern, it points to the official Astral installation URL, which is the standard method for this tool. - [COMMAND_EXECUTION]: The skill includes numerous examples of system commands for package management, virtual environment handling, and Docker builds. These are standard operational instructions for the documented tool.
Audit Metadata