The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary setup instructions and reference documentation (e.g., SKILL.md, references/uv-reference.md, references/ty-reference.md) explicitly recommend downloading and executing shell scripts from remote URLs (https://astral.sh/uv/install.sh and https://astral.sh/ty/install.sh) by piping them directly into sh. This pattern is highly dangerous as it allows an external server to execute arbitrary commands on the host system without any integrity verification or review.
[COMMAND_EXECUTION]: The skill promotes the use of just as a command runner and uv run for various project tasks. The provided templates for Justfile and pyproject.toml include recipes that execute shell commands, such as rm -rf, find ... -exec rm, and various tool invocations. While intended for development, this creates a mechanism for arbitrary command execution controlled by the configuration files.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of multiple external tools and dependencies (e.g., uv, ty, ruff, pytest, just) from various remote sources, including astral.sh and GitHub repositories. Relying on scripts and packages from external, non-whitelisted domains introduces supply-chain risks where a compromise of the source could lead to system infection.

python-dev