setup-tooluniverse

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to ask users for API keys and to insert those keys verbatim into configs, environment variable exports, and .env/project files (and shows example commands with the key in-place), which requires the LLM to handle and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs the agent to fetch and interpret content from public third‑party scientific databases (e.g., PubMed, UniProt, ChEMBL, FAERS, ClinicalTrials.gov in "What is ToolUniverse?") and to run/execute those tools (e.g., execute_tool("PubMed_search_articles") in "Step 4: Test Together") and even clone public GitHub skills (git clone https://github.com/mims-harvard/ToolUniverse.git in "Step 5"), so untrusted external content is ingested and directly influences the agent's tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs the agent/user to run curl -LsSf https://astral.sh/uv/install.sh | sh (which downloads and executes a remote install script at runtime) and to git clone --depth 1 https://github.com/mims-harvard/ToolUniverse.git /tmp/tu-skills (which fetches skills that will be installed and can directly control agent behavior), so both URLs are used at runtime to execute remote code or load content that controls prompts.