tech-preferences

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for initializing and configuring Python projects using commands like uv init, uv add, and uv run. It also suggests using just for task running, launchd for macOS daemons, and running vp --help for Vite-related tasks within the developer's environment.
  • [EXTERNAL_DOWNLOADS]: The skill uses uvx to run tools like ruff and ty. uvx is designed to download and execute packages from the PyPI registry. The skill also references official documentation for well-known services and organizations such as Astral and Python, and utilizes official GitHub Actions like astral-sh/setup-uv.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads project-specific configuration files and explores workspace directories to inform its technical recommendations.
  • Ingestion points: The skill reads pyproject.toml, uv.lock, and scans directory structures within the ~/workspace folder for specific organizations (e.g., zrr1999/, spore-lang/, volvox-ai/).
  • Boundary markers: No specific boundary markers or delimiters are identified to separate untrusted project data from the agent's instructions.
  • Capability inventory: The skill has the capability to explore the local file system and execute shell commands for project setup, dependency management, and tool invocation.
  • Sanitization: There are no explicit instructions to sanitize or validate the content of the project files before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 11:36 AM