UV Global

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 0.1.2
• Hash: 67a9690b5222283cc3afb924652fc45b3ea67342a0a9ecf11f4c865422066232
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the `install.sh` script's use of `curl -LsSf https://astral.sh/uv/install.sh | sh` to install the `uv` tool. While this is a common and official installation method, executing arbitrary remote shell scripts without prior inspection introduces a significant Remote Code Execution (RCE) vulnerability if the `astral.sh` domain or its content delivery network were ever compromised. This represents a risky capability rather than clear malicious intent by the skill author. The skill also installs a large number of Python packages, which, while legitimate, increases the overall attack surface.