setup-tooluniverse

Fail

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user to modify shell configuration files such as ~/.zshrc to persist environment variables, specifically for storing API keys.
  • [COMMAND_EXECUTION]: The skill automates the modification of agent memory and rule files (e.g., CLAUDE.md, .cursor/rules/tooluniverse.md) to maintain its presence and capabilities across different sessions.
  • [REMOTE_CODE_EXECUTION]: The skill fetches and executes an installation script from the official Astral domain via a piped shell command (curl -LsSf https://astral.sh/uv/install.sh | sh).
  • [EXTERNAL_DOWNLOADS]: The skill clones a repository of research-focused skills from the MIMS-Harvard GitHub organization and copies them directly into the agent's active configuration directories (e.g., .cursor/skills/).
  • [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by integrating external, unverified skill instructions from a remote repository into the agent's core execution environment.
  • Ingestion points: External skills are cloned from the ToolUniverse GitHub repository and placed into the agent's internal skills folders.
  • Boundary markers: None identified for the imported instructions.
  • Capability inventory: The integrated skills can trigger various tool executions across the research platform.
  • Sanitization: No validation or sanitization is performed on the imported skill content before integration.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 16, 2026, 08:26 AM