setup-celltypist-remote-tool
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a Python wheel from 'https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl'. This is an external source outside of standard package registries.
- Evidence: The 'Connect to ToolUniverse Connect' section provides a direct URL for installation.
- Mitigation: The download is pinned with a SHA-256 hash (#sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0), which ensures the integrity of the binary content.
- [REMOTE_CODE_EXECUTION]: The skill instructions include executing Python code directly through heredocs in the terminal, which is a method for running arbitrary scripts at runtime.
- Evidence: Multiple code blocks use 'python
- <<'PY'' to execute local test logic for MCP client validation.
- [COMMAND_EXECUTION]: The skill invokes several local Python scripts and CLI tools for preflight checks and model conversion.
- Evidence: Execution of 'scripts/remote_validation/setup_skill_preflight.py', 'src/tooluniverse/remote/celltypist/convert_pickle_model.py', and the 'tu' CLI for login and sharing operations.
- [CREDENTIALS_UNSAFE]: The skill references the handling of sensitive keys ('TOOLUNIVERSE_SERVICE_KEY', 'TOOLUNIVERSE_API_TOKEN') and environment files.
- Evidence: Instructions mention importing a '.env' file ('tu remote login --env-file /path/to/tooluniverse-service.env') and setting token variables.
- Context: The skill follows security best practices by recommending protected environment variables and 0600 file permissions rather than hardcoding values.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection as it processes external biological data files (.h5ad) and has capabilities to write to the filesystem and initiate network sharing.
- Ingestion points: 'CELLTYPIST_REMOTE_DATA_ROOT' points to external genomic data files.
- Boundary markers: None explicitly mentioned for the data ingestion phase.
- Capability inventory: Includes network sharing ('tu remote share'), environment modification, and file writing ('mkdir -p caches/celltypist').
- Sanitization: The skill implements a critical security control by using 'allow_pickle=False' when loading model data to prevent unsafe deserialization attacks.
Audit Metadata