The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (SAFE): The skill installs well-known Python development tools including ruff, pytest, ty, and pre-commit from the official Python Package Index (PyPI). It also references official GitHub repositories for pre-commit hooks (e.g., astral-sh/ruff-pre-commit).
[COMMAND_EXECUTION] (SAFE): Executes shell commands to manage virtual environments and install packages via pip, uv, or poetry. These operations are transparently documented in the workflow and are necessary for the skill's primary function of project initialization.
[Indirect Prompt Injection] (LOW): The skill has a surface for indirect prompt injection because it reads existing project files (like uv.lock or pyproject.toml) to detect the environment.
Ingestion points: Reads pyproject.toml and checks for uv.lock in the local project directory.
Boundary markers: None; the agent implicitly trusts the local project structure.
Capability inventory: Executes shell commands (pip, uv, poetry, pre-commit) and writes configuration files (.gitignore, pyproject.toml, .pre-commit-config.yaml).
Sanitization: None; project metadata is used to fill templates. However, the risk is minimal as the commands executed are for standard dev-tool setup.

python-starter