setup-scanvi-remote-tool

SUSPICIOUS. The skill’s behavior mostly matches its deployment/audit purpose, and credential handling is scoped to ToolUniverse auth. The main concern is install trust: it uses a direct third-party wheel URL for tuplatform-connect that does not match the stronger official documented source path, creating medium supply-chain risk even though the file hash is pinned.