tech-preferences
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for initializing and configuring Python projects using commands like
uv init,uv add, anduv run. It also suggests usingjustfor task running,launchdfor macOS daemons, and runningvp --helpfor Vite-related tasks within the developer's environment. - [EXTERNAL_DOWNLOADS]: The skill uses
uvxto run tools likeruffandty.uvxis designed to download and execute packages from the PyPI registry. The skill also references official documentation for well-known services and organizations such as Astral and Python, and utilizes official GitHub Actions likeastral-sh/setup-uv. - [INDIRECT_PROMPT_INJECTION]: The skill reads project-specific configuration files and explores workspace directories to inform its technical recommendations.
- Ingestion points: The skill reads
pyproject.toml,uv.lock, and scans directory structures within the~/workspacefolder for specific organizations (e.g.,zrr1999/,spore-lang/,volvox-ai/). - Boundary markers: No specific boundary markers or delimiters are identified to separate untrusted project data from the agent's instructions.
- Capability inventory: The skill has the capability to explore the local file system and execute shell commands for project setup, dependency management, and tool invocation.
- Sanitization: There are no explicit instructions to sanitize or validate the content of the project files before they are processed by the agent.
Audit Metadata