setup-uspto-downloader-remote-tool
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
tuplatform-connectrelay SDK from a remote server (connect.aiscientist.tools). This is a legitimate download for the tool's intended purpose, and the package integrity is verified using a SHA-256 hash pin (3fad5eee5ecf7887a693d93ccd1aa112dc0955617a885d1fc3daded0030f9ae0). - [COMMAND_EXECUTION]: The skill instructs the user to run various shell commands for environment setup (
venv), package installation (pip install), and server management (tu remote,tu serve). These are standard operational procedures for deploying this type of software. - [CREDENTIALS_SAFE]: The skill emphasizes safe credential management, explicitly warning against hardcoding keys in shell arguments or results. It recommends using environment variables, protected files (0600 permissions), or browser-based device authorization (
tu remote login). - [DATA_EXFILTRATION]: No patterns of unauthorized data exfiltration were detected. The skill uses a loopback bind by default and requires explicit tokens for non-loopback access to prevent accidental exposure.
- [REMOTE_CODE_EXECUTION]: While the skill installs a remote relay SDK, the process is transparent, versioned, and hash-pinned. There are no patterns of piped execution from unknown sources (e.g.,
curl | bash).
Audit Metadata