Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only Python packaging skill whose publishing commands are purpose-aligned, but users should review before running upload or cleanup examples.
Install this skill if you want Python packaging guidance. Before running examples, especially uv publish or the CI publishing workflow, verify the target registry, credentials, version, and package contents; only run rm -rf build/ dist/ from the intended project directory.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
uv build --no-isolation
rm -rf build/ dist/
### Import Errors
The trigger list includes very broad terms such as 'python', 'packaging', 'pip', and 'distribution', which are likely to match many unrelated user requests and cause unintended activation of this skill. In an agent setting, overbroad activation can route users into packaging or publishing guidance when they did not intend it, increasing the chance of inappropriate commands being suggested or executed.
The quick-start flow includes 'uv publish' without an explicit warning that this uploads package artifacts to PyPI, which may be irreversible and could expose private, unreviewed, or malicious code publicly. In a skill intended for agents, omission of that warning is risky because users may follow or auto-run the sequence as a standard setup procedure without recognizing the external publication step.
This markdown file includes uv publish examples for TestPyPI and PyPI, which send package contents and associated metadata to remote services. The surrounding documentation does not include any warning or disclosure about external transmission or the consequences of publishing, which is a safety-relevant omission for markdown guidance.
The trigger 'uv' is extremely short and ambiguous, making accidental activation likely in unrelated contexts where 'UV' refers to ultraviolet, shell aliases, abbreviations, or non-packaging topics. While lower impact than explicit dangerous commands, this increases the chance of incorrect skill routing and unnecessary exposure to packaging and publishing instructions.
No suspicious patterns detected.