setup-depmap-24q2-remote-tool
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
tuplatform-connectpackage fromconnect.aiscientist.tools. This is a resource belonging to the vendor (associated with the 'AI Scientist' project at Harvard MIMS). The installation command includes a SHA-256 checksum to ensure the integrity of the remote file. - [COMMAND_EXECUTION]: The instructions include several shell commands for environment management, dependency installation, and CLI operations (
tu remote,tu serve). These are standard for setting up a local or remote tool environment. - [INDIRECT_PROMPT_INJECTION]: The tool
compute_depmap24q2_gene_correlationstakes external data (gene names) as input. The skill documentation includes notes on validating these inputs, enforcing output bounds, and ensuring that tool results do not leak sensitive paths or secrets. - [DYNAMIC_EXECUTION]: The skill uses heredoc Python blocks (`python
- <<'PY'`) to run verification tests and tool examples. These blocks are static scripts embedded in the instructions for local verification and do not incorporate untrusted runtime data.
Audit Metadata