setup-transcriptformer-remote-tool
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a Python wheel file (
tuplatform_connect-0.3.0-py3-none-any.whl) fromconnect.aiscientist.tools. The download includes a SHA-256 integrity hash (sha256=3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0) to ensure the file has not been tampered with. While this is an external domain, the documentation presents it as a specific tool (tuplatform-connect) required for the skill's primary purpose of connecting to the ToolUniverse platform. - [COMMAND_EXECUTION]: The instructions involve executing several shell commands and Python scripts (e.g.,
tu remote login,tu serve, and validation scripts). These are standard operational procedures for setting up and testing a remote tool implementation. The skill explicitly warns against putting sensitive tokens likeTOOLUNIVERSE_API_TOKENin shell arguments, which is a positive security practice. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill mentions managing credentials through
TOOLUNIVERSE_SERVICE_KEYand.envfiles. It includes a specific warning to keep provider data, weights, caches, and credentials outside of Git and to bind services to loopback (127.0.0.1) to prevent unintended network exposure.
Audit Metadata