The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a Python package directly from a remote URL: https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl. While the command includes a SHA-256 integrity hash (3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0), the source is an external domain rather than a standard repository like PyPI.
[COMMAND_EXECUTION]: The skill provides numerous shell command blocks that perform environment manipulation, including creating virtual environments, installing local packages in editable mode (pip install -e .), and running local server processes. These commands are intended for setup but require significant user trust in the underlying scripts.
[CREDENTIALS_UNSAFE]: The skill documentation references sensitive environment variables TOOLUNIVERSE_API_TOKEN and TOOLUNIVERSE_SERVICE_KEY. Although it explicitly warns against placing these keys in shell arguments or Git and recommends using files with 0600 permissions, the workflow involves handling long-lived credentials.
[REMOTE_CODE_EXECUTION]: The process of installing a remote wheel file and executing internal preflight scripts (scripts/remote_validation/setup_skill_preflight.py) constitutes remote code execution risks if the source repository or the download server is compromised.

setup-ldsc-remote-tool