python-initializr
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a standard .gitignore configuration file from the official GitHub 'github/gitignore' repository. This operation targets a well-known, trusted source and is a standard part of project initialization.
- [COMMAND_EXECUTION]: Employs the 'uv' CLI to initialize the project structure, install development dependencies, and run validation checks such as tests and linters. These commands are necessary for the skill's intended functionality of setting up a local development environment.
- [REMOTE_CODE_EXECUTION]: Configures and runs 'pre-commit' hooks, which involves downloading and executing specific versions of linting and formatting tools. The configuration templates point to official, widely-used repositories (e.g., astral-sh, psf, pycqa), representing standard and safe use of the pre-commit framework.
- [PROMPT_INJECTION]: The skill interpolates user-provided data such as 'project_name' and 'project_description' into shell commands and configuration files. While this represents a theoretical surface for indirect injection, it is the standard mechanism for project scaffolding and occurs within the scope of the user's requested project setup.
Audit Metadata