setup-immune-compass-remote-tool
Warn
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of a Python wheel from a remote URL: https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl. The domain is not a recognized trusted organization or a standard package registry.
- [REMOTE_CODE_EXECUTION]: Installing a Python wheel (.whl) file from an external source involves executing code during the installation process and subsequent loading of the package into the environment.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands and local Python scripts, including scripts/remote_validation/setup_skill_preflight.py, src/tooluniverse/remote/immune_compass/convert_checkpoint.py, and the tu (ToolUniverse) CLI for authentication and deployment.
- [DATA_EXPOSURE]: The skill references and handles sensitive environment variables like TOOLUNIVERSE_API_TOKEN and TOOLUNIVERSE_SERVICE_KEY. Although it provides instructions to mitigate risk, such as using loopback binds and restricted file permissions (0600), the handling of these credentials requires user verification.
Audit Metadata