setup-tangram-remote-tool
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a project-specific SDK ('tuplatform-connect') from a remote URL. This is documented as a necessary component for the skill's primary purpose. The URL 'https://connect.aiscientist.tools/downloads/tuplatform_connect-0.3.0-py3-none-any.whl' includes a SHA-256 integrity hash ('#sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0'), which is a security best practice to ensure the file has not been tampered with.
- [COMMAND_EXECUTION]: The skill provides instructions to execute local Python scripts ('scripts/remote_validation/setup_skill_preflight.py') and start a local MCP server ('python -m tooluniverse.remote.tangram.tangram_tool'). These commands are part of the intended workflow for setting up the bioinformatics tool.
- [SAFE_PRACTICES]: The skill demonstrates high security awareness by explicitly instructing users to keep credentials and provider data outside of Git, recommending the use of '.env' files for secrets, and advising against passing API tokens as command-line arguments. It also utilizes short-lived device codes for authentication to avoid manual key handling.
Audit Metadata