setup-tooluniverse
Fail
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to modify shell configuration files such as
~/.zshrcto persist environment variables, specifically for storing API keys. - [COMMAND_EXECUTION]: The skill automates the modification of agent memory and rule files (e.g.,
CLAUDE.md,.cursor/rules/tooluniverse.md) to maintain its presence and capabilities across different sessions. - [REMOTE_CODE_EXECUTION]: The skill fetches and executes an installation script from the official Astral domain via a piped shell command (
curl -LsSf https://astral.sh/uv/install.sh | sh). - [EXTERNAL_DOWNLOADS]: The skill clones a repository of research-focused skills from the MIMS-Harvard GitHub organization and copies them directly into the agent's active configuration directories (e.g.,
.cursor/skills/). - [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by integrating external, unverified skill instructions from a remote repository into the agent's core execution environment.
- Ingestion points: External skills are cloned from the ToolUniverse GitHub repository and placed into the agent's internal skills folders.
- Boundary markers: None identified for the imported instructions.
- Capability inventory: The integrated skills can trigger various tool executions across the research platform.
- Sanitization: No validation or sanitization is performed on the imported skill content before integration.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata