Skills
Navigate
skills/mims-harvard/tooluniverse/setup-macs3-remote-tool/Gen Agent Trust Hub

setup-macs3-remote-tool

Warn

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a Python wheel file for tuplatform-connect from an external domain (https://connect.aiscientist.tools/) that is not identified as a trusted or well-known service in the security configuration.
  • [REMOTE_CODE_EXECUTION]: The downloaded wheel is installed using pip and its functionality is executed through CLI commands like tu serve, representing the execution of unverified remote code.
  • [COMMAND_EXECUTION]: The skill runs multiple shell commands, including a local preflight script (scripts/remote_validation/setup_skill_preflight.py) and the tu CLI utility, which handles remote server initialization and tool relaying.
  • [CREDENTIALS_UNSAFE]: The instructions direct the agent to handle sensitive credentials and suggest loading environment files from absolute paths using the tu remote login --env-file command, which poses a risk of credential exposure.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 11, 2026, 05:27 PM