devtu-create-tool
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch package metadata from the official Python Package Index (PyPI) to evaluate dependency requirements. This targets a well-known, trusted registry.
- [REMOTE_CODE_EXECUTION]: Includes a shell command using a piped execution pattern (
curl | python3) to parse JSON metadata from PyPI. The command uses the Python-cflag to execute a local metadata-processing script, ensuring that content from the network is treated as data rather than executable code. - [COMMAND_EXECUTION]: Contains numerous instructions for shell commands related to framework setup, registration verification, and automated testing. This includes the
tu.load_tools()method, which generates Python wrappers based on JSON configurations as part of the framework's core functionality. - [DATA_EXFILTRATION]: Provides templates for scientific tools that make network requests. It follows security best practices by instructing developers to use environment variables for sensitive API keys instead of hardcoding them or accepting them as tool inputs.
Audit Metadata