python-env

[Skill Scanner] Installation of third-party script detected All findings: [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Instruction directing agent to run/execute external content (CI011) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] The documentation itself is benign but contains a high-risk installation instruction that fetches and executes a remote shell script (curl ... | sh) from astral.sh without integrity verification. That single pattern constitutes a supply-chain risk and should be treated with caution. No other explicit malicious code or hard-coded secrets are present in the provided text. Recommend: (1) avoid piping remote scripts directly to sh; (2) obtain uv from signed releases or package managers; (3) audit the installer and uv code before use; (4) clarify which package registries uv uses and whether it proxies traffic. LLM verification: This SKILL.md is documentation-only and contains no embedded malware, but it presents moderate supply-chain risk due to missing provenance for the 'uv' tool and repeated examples of unpinned package installation and commands that execute third-party code. If a user follows these instructions blindly (particularly installing an unknown 'uv' binary or unpinned dependencies) they could expose their system to malicious or compromised packages. Recommend: add explicit provenance for `uv` (official re