{
  "verdict": "warnings",
  "target": {
    "cacheKey": "github:astral-sh/uv@b73e597cb1aa3d962dd2df5c692718ba4d851969",
    "host": "github",
    "owner": "astral-sh",
    "name": "uv",
    "requestedRef": "",
    "sha": "b73e597cb1aa3d962dd2df5c692718ba4d851969",
    "defaultBranch": "main"
  },
  "summary": null,
  "summary_model": null,
  "findings": [
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:Claude Code hook manifest",
      "statement": "The repository ships 2 Claude Code hook manifests. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".claude/settings.json, .codex/hooks.json",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:agent skill definition",
      "statement": "The repository ships 1 agent skill definition. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": ".codex/skills/load-github-action-thread/SKILL.md",
      "method": "tree"
    },
    {
      "check": "agent-config",
      "severity": "warning",
      "concern": "agent-config:hooks",
      "statement": "The hook manifest registers 2 lifecycle hooks: PostToolUse, SessionStart. Hooks run when their event fires, without the user invoking anything by name.",
      "evidence": ".claude/settings.json, .codex/hooks.json",
      "method": "file"
    },
    {
      "check": "prose",
      "severity": "warning",
      "concern": "prose:the project states a limit on what its security policy covers",
      "statement": "The project states a limit on what its security policy covers. The sentence it says that in is quoted verbatim, from SECURITY.md.",
      "evidence": "SECURITY.md",
      "method": "prose"
    },
    {
      "check": "prose",
      "severity": "warning",
      "concern": "prose:the documentation advertises piping a downloaded script straight into a shell",
      "statement": "The documentation advertises piping a downloaded script straight into a shell. The sentence it says that in is quoted verbatim, from README.md.",
      "evidence": "README.md",
      "method": "prose"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:agent instruction file",
      "statement": "The repository ships 2 agent instruction files. A harness that indexes a cloned working tree can pick these up without any install step being run.",
      "evidence": "AGENTS.md, CLAUDE.md",
      "method": "tree"
    },
    {
      "check": "unauditable-surface",
      "severity": "note",
      "concern": "unauditable-surface:committed-binaries",
      "statement": "26 compiled or packaged artefacts are committed to the repository. Reading the source does not tell you what these contain.",
      "evidence": "crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-console.exe, crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-gui.exe, crates/uv-trampoline-builder/trampolines/uv-trampoline-i686-console.exe, and 23 more",
      "method": "tree"
    },
    {
      "check": "install-path",
      "severity": "note",
      "concern": "install-path:build-backend",
      "statement": "The Python build backend is maturin. A pip install runs this backend, which compiles or generates whatever the backend is configured to produce.",
      "evidence": "pyproject.toml build-system",
      "method": "file"
    },
    {
      "check": "agent-config",
      "severity": "note",
      "concern": "agent-config:hook-commands",
      "statement": "The hook manifest runs 2 commands. The first is quoted verbatim.",
      "evidence": ".claude/settings.json, .codex/hooks.json",
      "method": "file",
      "quote": "bash agents/hooks/session-start.sh"
    },
    {
      "check": "unauditable-surface",
      "severity": "clean",
      "concern": "unauditable-surface:census",
      "statement": "3% of the repository by size (42 of 1734 files) is binary or generated and cannot be reviewed by reading.",
      "evidence": "file listing at the analysed commit",
      "method": "tree"
    },
    {
      "check": "install-path",
      "severity": "clean",
      "concern": "install-path:verification",
      "statement": "The latest release publishes integrity files (source.tar.gz.sha256, uv-aarch64-apple-darwin.tar.gz.sha256, uv-aarch64-pc-windows-msvc.zip.sha256, and 16 more). No install script is committed to the repository, so how they are consumed depends on the instructions you follow.",
      "evidence": "release 0.12.10",
      "method": "api"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:activity",
      "statement": "The last push was 1 day ago (2026-09-05).",
      "evidence": "GitHub repository pushed_at field",
      "method": "api"
    },
    {
      "check": "trust-root",
      "severity": "clean",
      "concern": "trust-root:concentration",
      "statement": "Among the 100 most active contributors, the busiest (charliermarsh) accounts for about 33% of commits.",
      "evidence": "GitHub contributors API, first page",
      "method": "api"
    }
  ],
  "not_checked": [
    "OpenSSF Scorecard has no published result for this repository, so its maintenance-hygiene score is not shown.",
    "Nothing was executed. The installer was not run, the package was not installed, and no binary was launched, so every statement here is about what the code says it does rather than what it did.",
    "The contents of compiled and generated files were not reviewed. They can only be read by running the project's own build or by disassembly.",
    "Install scripts hosted outside this repository were not fetched. Only scripts committed to the repository itself are read."
  ],
  "prose_excerpts": [
    {
      "path": "SECURITY.md",
      "reason": "the project states a limit on what its security policy covers",
      "text": "These are not considered vulnerabilities in uv."
    },
    {
      "path": "README.md",
      "reason": "the documentation advertises piping a downloaded script straight into a shell",
      "text": "curl -LsSf https://astral.sh/uv/install.sh | sh ```"
    }
  ],
  "scorecard": null,
  "stats": {
    "filesInTree": 1734,
    "totalBytes": 39980738,
    "opaqueBytes": 1157571,
    "filesFetched": 8,
    "fetchBudgetExhausted": false
  },
  "generated_at": "2026-09-05T15:47:09.035Z"
}