python-conventions
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute various shell commands including
uv run,pytest, andruff. While standard for development, these commands execute code defined within the project files. - [EXTERNAL_DOWNLOADS]: The skill mandates the use of
uv addfor package management, which fetches and installs dependencies from the Python Package Index (PyPI). PyPI is a well-known and standard service for the Python ecosystem. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted data (source code and project configuration).
- Ingestion points: Processes
.pyfiles andpyproject.tomlconfiguration files. - Boundary markers: No specific delimiters or warnings to ignore embedded instructions are defined for the agent when reading file content.
- Capability inventory: The agent can execute commands (
uv run), install packages (uv add), and run tests (pytest), all of which interact with the project environment. - Sanitization: The skill does not provide mechanisms for sanitizing or validating the content of the Python files before they are processed by the agent.
Audit Metadata