setup-scrublet-remote-tool
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a Python wheel (
tuplatform_connect) fromconnect.aiscientist.tools. This download is performed using a pinned SHA-256 hash (sha256=3fad5eee...), which is a security best practice that ensures the integrity of the downloaded file. - [CREDENTIALS_SAFE]: The instructions demonstrate a strong security posture regarding secrets. They explicitly warn the user never to put API tokens or service keys in shell arguments or results. Instead, they recommend using protected environment variables or local configuration files with restricted permissions (0600).
- [COMMAND_EXECUTION]: The skill provides commands for setting up isolated Python virtual environments, installing dependencies, and managing the ToolUniverse server. These are standard deployment operations appropriate for the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill documents an MCP tool (
run_scrublet_doublets) that ingests data paths (adata_path). While this represents a data ingestion surface, the skill includes guidance on verifying data rights and checking for the absence of paths or secrets in output, which helps mitigate risks associated with processing external files.
Audit Metadata