tooluniverse-claude-code-plugin
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download 'uv' from
astral.shand the ToolUniverse plugin from the author's official GitHub repository (mims-harvard/ToolUniverse). These are standard operations for installing the required runtime and the plugin itself. - [COMMAND_EXECUTION]: The skill provides several shell commands and a Python snippet to configure the environment. This includes registering the plugin marketplace, installing the plugin, enabling auto-updates in the local configuration file (
~/.claude/plugins/known_marketplaces.json), and cleaning up old global skill files. These operations are transparent, well-documented, and consistent with the skill's stated purpose of installation and maintenance. - [REMOTE_CODE_EXECUTION]: While the skill contains a
curl | shcommand for installing 'uv', this is the standard, official installation method for a well-known developer tool. The use-case is legitimate within the context of setting up prerequisites for the plugin.
Audit Metadata