skill-python-env

• Analyzed: May 11, 2026, 1:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 48873494b5a0eba8d3c50ed4f5f81b7ce54bcffa65b09a530d727dbe38378076
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a utility for managing Python virtual environments but includes high-risk behaviors in its setup process. Specifically, `ensure_python_env.sh` and `ensure_python_env.py` are designed to automatically download and execute remote shell scripts and PowerShell commands from `https://astral.sh` to install the `uv` package manager. While this is aligned with the stated purpose of 'zero-dependency' installation, the use of 'curl|sh' and 'Invoke-Expression' (iex) patterns constitutes a significant security risk for remote code execution (RCE) via supply chain or network compromise.