setup-milo-remote-tool
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading a binary Python wheel file from an unverified external domain (
https://connect.aiscientist.tools/). This domain is not a recognized trusted vendor or a standard public package registry. - [REMOTE_CODE_EXECUTION]: Instructions specify installing the downloaded binary package via
pip, which results in the execution of external code on the host system. The skill notes that this package is not yet published on standard registries. - [COMMAND_EXECUTION]: The documentation provides numerous shell commands for setting up virtual environments, installing dependencies, and managing authentication keys (
tu remote login) that interact with the local filesystem and network. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting external data files (
.h5ad) into a tool context. The documentation acknowledges that 'independent-caller authorization/isolation remain untested' and 'recovery remain incomplete,' which increases the risk that maliciously crafted data could influence the agent's behavior or the execution environment.
Recommendations
- AI detected serious security threats
Audit Metadata