Skills uv-package-manager

📦

uv-package-manager

Name: uv-package-manager
Author: sickn33

Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access

Manage Python Projects With uv

Python dependency tools can be slow and inconsistent across local, CI, and container workflows. This skill gives uv commands and patterns for faster installs, virtual environments, lockfiles, and migration.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "uv-package-manager" from https://skillstore.io/skills/sickn33-uv-package-manager.md and its manifest at https://skillstore.io/api/skills/sickn33-uv-package-manager/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-uv-package-manager.md Signed manifest GET /api/skills/sickn33-uv-package-manager/manifest Signed lockfile GET /api/skills/sickn33-uv-package-manager/lockfile

Test it

Using "uv-package-manager". I need to migrate a small Flask service from pip to uv.

Expected outcome:

A migration plan with inventory steps, uv initialization guidance, dependency syncing, lockfile handling, test verification, and rollback notes.

Using "uv-package-manager". Our CI installs Python dependencies too slowly.

Expected outcome:

Recommendations for uv caching, frozen syncs, lockfile use, parallel installs, and a clear verification checklist.

Using "uv-package-manager". I need Docker guidance for a uv project.

Expected outcome:

A Docker workflow outline that separates dependency installation from application code and explains how to keep builds reproducible.

Security Audit

Critical

v4 • 7/7/2026 Open versioned report

The skill is documentation-only Markdown, and most static alerts are false positives from comments, Markdown backticks, placeholder URLs, and project-local .venv paths. The install examples still include remote script execution and a ~/.bashrc write, which are real risks if an agent or user runs them without confirmation.

Files scanned

869

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Critical

resources/implementation-playbook.md:54

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh

The command pipes a remotely downloaded installer directly into sh. This is a classic remote code execution pattern and lacks checksum or signature verification in the example.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

resources/implementation-playbook.md:57

PowerShell invocation

powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

The example runs PowerShell to download an external installer and execute it through iex. If copied or run by an agent, this is remote code execution without integrity verification.

High

resources/implementation-playbook.md:679

Hidden file in home directory

echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc

The command appends to ~/.bashrc, which changes future shell startup behavior. Even though it is a PATH fix, modifying a home dotfile should require explicit confirmation.

High

resources/implementation-playbook.md:679

Hidden file access

echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc

The command writes to ~/.bashrc, a hidden shell startup file. This is a persistent user-environment change and should not be automated without approval.

Low

resources/implementation-playbook.md:54

Hardcoded URL

curl -LsSf https://astral.sh/uv/install.sh | sh

The line fetches an installer from an external URL. The URL is for the uv project, but the network dependency is real and is paired with shell execution.

Low

resources/implementation-playbook.md:57

Hardcoded URL

powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

The line fetches a PowerShell installer from an external URL before execution. The URL appears to be a uv install source, but it remains an external network dependency.

Low

resources/implementation-playbook.md:66

Hardcoded URL

cargo install --git https://github.com/astral-sh/uv uv

The cargo install example pulls source code from GitHub without a pinned commit. This is a normal install path, but it still relies on external network code.

Risk Factors

⚙️ External commands (5)

resources/implementation-playbook.md:56 resources/implementation-playbook.md:57 resources/implementation-playbook.md:141 SKILL.md:33 SKILL.md:37

🌐 Network access (7)

resources/implementation-playbook.md:54 resources/implementation-playbook.md:57 resources/implementation-playbook.md:66 resources/implementation-playbook.md:187 resources/implementation-playbook.md:190 resources/implementation-playbook.md:321 resources/implementation-playbook.md:600

📁 Filesystem access (7)

resources/implementation-playbook.md:487 resources/implementation-playbook.md:679 resources/implementation-playbook.md:447 resources/implementation-playbook.md:451 resources/implementation-playbook.md:487 resources/implementation-playbook.md:659 resources/implementation-playbook.md:679

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-uv-package-manager/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-uv-package-manager/security.svg)](https://skillstore.io/skills/sickn33-uv-package-manager?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-uv-package-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-uv-package-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-uv-package-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). uv-package-manager security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-uv-package-manager/audits/4

BibTeX citation

@techreport{sickn33-sickn33-uv-package-manager-2026,
  author = {sickn33},
  title = {uv-package-manager security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/sickn33-uv-package-manager/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "uv-package-manager security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-uv-package-manager/audits/4"
identifiers:
  - type: other
    value: "skillstore:sickn33-uv-package-manager:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Recently maintained

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-uv-package-manager

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

ActiveInferenceInstitute

activeinferenceinstitute-uv-package-manager

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

sickn33 Current

sickn33-uv-package-manager

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a Fast Python Project

Initialize a uv project, pin Python, add runtime and development dependencies, and run tests through uv.

Speed Up CI Builds

Use lockfiles, frozen installs, cache reuse, and GitHub Actions patterns to make Python CI more reproducible.

Migrate Existing Projects

Move from pip, requirements files, pip-tools, or Poetry while preserving existing project metadata.

Try These Prompts

Create a New Project

Use the uv package manager skill to plan a new Python web API project. Include setup steps, dependency groups, and verification commands.

Migrate From pip

Use this skill to migrate an existing requirements.txt project to uv. Keep the workflow simple and explain each file change.

Prepare CI With Lockfiles

Use the uv skill to design a GitHub Actions workflow with frozen installs, caching, tests, and dependency updates.

Design a Monorepo Workflow

Use the uv skill to propose a workspace layout for three Python packages with shared tooling, lockfile policy, and Docker guidance.

Best Practices

Commit uv.lock for applications and use frozen installs in CI.
Review install commands before executing remote scripts or modifying shell startup files.
Prefer uv run for project commands so environments stay consistent.

Avoid

Piping installer scripts to a shell without confirmation or integrity checks.
Editing global shell startup files when a project-local PATH change is enough.
Mixing pip, Poetry, and uv commands without a clear migration plan.

Frequently Asked Questions

What is uv?

uv is a fast Python package and project manager that handles dependencies, virtual environments, Python versions, and lockfiles.

Can this skill help migrate from pip or Poetry?

Yes. It includes migration patterns from requirements files, pip-tools, and Poetry to uv workflows.

Does it support CI and Docker workflows?

Yes. It provides patterns for GitHub Actions, lockfile installs, caching, and Docker build optimization.

Will it run commands automatically?

No. It provides guidance and examples. The user or agent must decide which commands are appropriate.

Are remote installer commands safe?

They can be risky because they execute downloaded code. Review the source, prefer package managers, and seek confirmation first.

Can it troubleshoot uv errors?

Yes. It covers common PATH, Python version, dependency resolution, cache, and lockfile issues.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/uv-package-manager

Ref

f93e9bb0daca99badb6a7e574b97737155d57cb3

Maintenance freshness

7/18/2026

Usage

5 downloads · 107 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md