setup-pinnacle-remote-tool

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download requirements configuration and a specific Python package from external sources. The downloads target the author's GitHub repository and a project-specific domain. The Python wheel installation includes a SHA-256 integrity hash to ensure the package has not been tampered with.
  • Evidence: curl -fsSL -o ~/.tooluniverse/envs/pinnacle-tooluniverse.txt https://connect.aiscientist.tools/install-requirements.txt
  • Evidence: curl -fsSL -o ~/.tooluniverse/envs/pinnacle-requirements.txt https://raw.githubusercontent.com/mims-harvard/ToolUniverse/main/src/tooluniverse/remote/pinnacle/requirements.txt
  • Evidence: python -m pip install ... "tuplatform-connect @ https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl#sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0"- [COMMAND_EXECUTION]: The documentation includes various shell commands for environment setup, dependency installation, and service management using tools like uv, pip, and the project's tu CLI. These are provided as static instructions for the user or agent to follow during deployment.- [CREDENTIALS_UNSAFE]: While the skill discusses the use of sensitive environment variables like TOOLUNIVERSE_SERVICE_KEY and TOOLUNIVERSE_API_TOKEN, it explicitly warns against placing them in command-line arguments and recommends secure authentication methods such as tu remote login or protected environment files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:27 PM