Security audit

Prioritize uv

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about forcing uv usage for Python work, but its always-on scope and unpinned uvx execution make it broad enough to warrant Review before installation.

Install only if you intentionally want an always-on policy that routes Python commands through uv. Review projects with pinned, offline, hermetic, or non-uv workflows carefully, and prefer project-managed locked tools over unpinned uvx or @latest commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:2
Finding: Always-On Instructions Override the Agent's Command-Execution Policy
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Third-Party Tools Are Downloaded and Executed Through uvx
Content: View full analysis
Remediation: View remediation
`, subject to the exact syntax supported by the deployed `uv` version. 3. Prefer project-managed development dependencies recorded in a reviewed `pyproject.toml` and committed `uv.lock` file. 4. Require frozen or locked resolution so package versions cannot silently change between runs. 5. Use a trusted internal package mirror or an explicitly allowlisted package index rather than accepting arbitrary environment-configured indexes. 6. Verify package provenance and hashes where supported, and review transitive dependencies before approval. 7. Require user confirmation before the first download or execution of any external tool. 8. Run third-party tools in a sandbox with minimal filesystem access, no unnecessary secrets, and restricted outbound networking. 9. Avoid installing dependency managers or other high-impact tools through one-off, unpinned `uvx` commands. 10. Establish an update process in which version changes are reviewed and tested before lock files or approved versions are updated. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is marked effectively mandatory and activates on virtually any Python-related mention, forcing command rewrites across a very broad set of tasks. Overbroad always-on behavior can override safer task-specific instructions, trigger unnecessary package/tool execution, and increase the attack surface when combined with dynamic uv/uvx usage.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'Use when' section covers nearly every Python-related activity without clear boundaries, making the skill applicable far beyond a narrow package-management helper. In context, this amplifies the risk of unsafe or inappropriate command substitution across unrelated workflows and reduces operator control.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document includes mandatory instructional content in Portuguese such as 'Ferramenta do projeto' and 'precisa importar seus módulos' without offering a language choice. This can violate language policy expectations because users are not given an opt-in or alternative language selection.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs use of uvx ruff check . without pinning a version. uvx resolves and executes packages from a registry at runtime, so unpinned usage can lead to supply-chain drift, unexpected behavior changes, or execution of a compromised latest release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This line recommends unpinned uvx ruff, which fetches and runs the current package version. That creates a supply-chain risk because behavior can change over time or a malicious upstream release could be executed implicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Several example comments are written in Portuguese, including explanations for ruff, black, mypy, and isort usage. Because these examples are part of the core guidance and no language preference is offered, the skill implicitly imposes a locale on users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The example uses uvx black . without constraining the version. Running unpinned remote CLI packages increases exposure to compromised upstream releases and non-reproducible execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill directs use of unpinned uvx mypy ., which permits runtime retrieval of whichever version is latest or otherwise resolved. That can introduce supply-chain compromise risk and inconsistent analysis results across environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This unpinned uvx isort . example can execute an unreviewed upstream version at runtime. For security-sensitive agent behavior, that creates unnecessary dependence on mutable external state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The examples for pytest, application execution, and dbt include Portuguese-only explanatory text as part of the main operational instructions. This creates a language/locale constraint without documenting user choice or a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The guidance allows uvx pytest as a one-off without version pinning. That means the agent may fetch and execute whatever pytest release resolves at runtime, creating reproducibility and supply-chain integrity concerns.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This line repeats unpinned uvx pytest tests/ guidance. Executing unpinned external packages increases the chance of malicious or breaking upstream changes affecting agent behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The example recommends unpinned uvx black ., which can pull a mutable version from the package source at execution time. This weakens supply-chain control and reproducibility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This line promotes unpinned uvx ruff check ., exposing users to mutable upstream package resolution. Even for developer tools, agent instructions should avoid implicit execution of latest remote code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using uvx mypy . without a fixed version introduces external mutable dependency execution. That can lead to compromised tool execution or inconsistent output between runs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The table suggests uvx pytest without version pinning. Because uvx resolves packages dynamically, this opens a supply-chain and reproducibility risk in agent-directed command execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The uvx black . example is unpinned and therefore executes a mutable external package version. This is a standard supply-chain hardening issue rather than an overtly malicious instruction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The unpinned uvx ruff check . guidance can cause the agent to fetch and run a changing upstream release. In an always-on skill, repeated use amplifies the risk surface.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This uvx mypy . example lacks version pinning, allowing arbitrary future versions to be executed. That is dangerous because security and behavior now depend on external package state at runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill recommends unpinned uvx flake8, which is a remote package execution path without immutability. This can expose users to malicious or simply incompatible upstream changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The unpinned uvx pylint command executes a mutable external dependency. In a mandatory skill, that behavior could be applied widely across sessions, increasing the blast radius of an upstream compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This uvx isort . example is unpinned and therefore subject to supply-chain drift. The risk is not from isort specifically, but from instructing dynamic execution of remote packages without version control.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The line recommends uvx poetry without version pinning. That can result in execution of a mutable upstream tool version, which is unsafe for deterministic and trustworthy agent behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.