setup-pinnacle-remote-tool
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download requirements configuration and a specific Python package from external sources. The downloads target the author's GitHub repository and a project-specific domain. The Python wheel installation includes a SHA-256 integrity hash to ensure the package has not been tampered with.
- Evidence:
curl -fsSL -o ~/.tooluniverse/envs/pinnacle-tooluniverse.txt https://connect.aiscientist.tools/install-requirements.txt - Evidence:
curl -fsSL -o ~/.tooluniverse/envs/pinnacle-requirements.txt https://raw.githubusercontent.com/mims-harvard/ToolUniverse/main/src/tooluniverse/remote/pinnacle/requirements.txt - Evidence:
python -m pip install ... "tuplatform-connect @ https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl#sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0"- [COMMAND_EXECUTION]: The documentation includes various shell commands for environment setup, dependency installation, and service management using tools likeuv,pip, and the project'stuCLI. These are provided as static instructions for the user or agent to follow during deployment.- [CREDENTIALS_UNSAFE]: While the skill discusses the use of sensitive environment variables likeTOOLUNIVERSE_SERVICE_KEYandTOOLUNIVERSE_API_TOKEN, it explicitly warns against placing them in command-line arguments and recommends secure authentication methods such astu remote loginor protected environment files.
Audit Metadata