setup-celltypist-remote-tool

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a Python wheel from 'https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl'. This is an external source outside of standard package registries.
  • Evidence: The 'Connect to ToolUniverse Connect' section provides a direct URL for installation.
  • Mitigation: The download is pinned with a SHA-256 hash (#sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0), which ensures the integrity of the binary content.
  • [REMOTE_CODE_EXECUTION]: The skill instructions include executing Python code directly through heredocs in the terminal, which is a method for running arbitrary scripts at runtime.
  • Evidence: Multiple code blocks use 'python
  • <<'PY'' to execute local test logic for MCP client validation.
  • [COMMAND_EXECUTION]: The skill invokes several local Python scripts and CLI tools for preflight checks and model conversion.
  • Evidence: Execution of 'scripts/remote_validation/setup_skill_preflight.py', 'src/tooluniverse/remote/celltypist/convert_pickle_model.py', and the 'tu' CLI for login and sharing operations.
  • [CREDENTIALS_UNSAFE]: The skill references the handling of sensitive keys ('TOOLUNIVERSE_SERVICE_KEY', 'TOOLUNIVERSE_API_TOKEN') and environment files.
  • Evidence: Instructions mention importing a '.env' file ('tu remote login --env-file /path/to/tooluniverse-service.env') and setting token variables.
  • Context: The skill follows security best practices by recommending protected environment variables and 0600 file permissions rather than hardcoding values.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection as it processes external biological data files (.h5ad) and has capabilities to write to the filesystem and initiate network sharing.
  • Ingestion points: 'CELLTYPIST_REMOTE_DATA_ROOT' points to external genomic data files.
  • Boundary markers: None explicitly mentioned for the data ingestion phase.
  • Capability inventory: Includes network sharing ('tu remote share'), environment modification, and file writing ('mkdir -p caches/celltypist').
  • Sanitization: The skill implements a critical security control by using 'allow_pickle=False' when loading model data to prevent unsafe deserialization attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 08:20 AM
Security Audit — agent-trust-hub — setup-celltypist-remote-tool