tooluniverse-custom-tool
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the creation of tools that ingest data from external APIs, creating a potential surface for indirect prompt injection from remote content.
- Ingestion points: Custom tools are designed to fetch data from external endpoints (e.g., https://my-api.example.com/search) as shown in the Python and JSON examples in SKILL.md and references/python-tool.md.
- Boundary markers: The skill documentation recommends defining a return_schema to validate the structure of the data returned by the tool's run() method.
- Capability inventory: Custom tools possess the capability to perform network requests using the requests library and execute arbitrary Python logic within the run() method.
- Sanitization: The return_schema provides structural validation of the response data, though it does not explicitly filter the content of text fields for malicious instructions.
- [DYNAMIC_EXECUTION]: The skill describes a plugin architecture that involves the dynamic discovery and execution of Python-based tools.
- Discovery mechanism: The documentation states that the plugin system automatically imports all .py files in a package via _discover_entry_point_plugins() to register tools using the @register_tool decorator.
- Runtime execution: Tools are executed via their run() method when called by the agent or through the tu test CLI utility.
- [SAFE]: The documentation includes explicit guidance on secure secret management, instructing developers to store API keys in .env files rather than hardcoding them in tool configuration files.
Audit Metadata