tooluniverse-claude-code-plugin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow starts the ToolUniverse MCP server (uvx tooluniverse) which then fetches/aggregates research content from external public biomedical databases (e.g., PubMed/EuropePMC/Semantic Scholar) and returns that free-text into the agent context via MCP tool calls like find_tools/get_tool_info/execute_tool, creating an indirect prompt-injection surface from outsider-authored web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README explicitly advises running a remote installer with curl -LsSf https://astral.sh/uv/install.sh | sh which fetches and immediately executes remote shell code as part of setup (and the plugin relies on the uv/uvx runtime to pull/execute the tooluniverse package), so this is a runtime fetch-and-execute dependency.