ToolUniverse is a collection of tools, interfaces, and supporting components for building AI systems that perform scientific work. It is for developers creating AI scientist agents that use APIs, databases, machine-learning tools, and domain-specific utilities. The catalogue includes skills, commands, an MCP server, an agent, and a hook for working with the ecosystem.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mims-harvard/ToolUniverse --skill tooluniverse-self-reviewgit clone --depth 1 https://github.com/mims-harvard/ToolUniverseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mims-harvard/tooluniverse/tooluniverse-self-review)<a href="https://agentmods.dev/skills/mims-harvard/tooluniverse/tooluniverse-self-review"><img src="https://agentmods.dev/badge/skills/mims-harvard/tooluniverse/tooluniverse-self-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mims-harvard/tooluniverse/tooluniverse-self-review"><img src="https://agentmods.dev/badge/skills/mims-harvard/tooluniverse/tooluniverse-self-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 86 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Excessive Agency · line 60 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00152 | $0.01942 |
| Opus 5.5 | $0.00061 | $0.00777 |
| Sonnet 5.5 | $0.00030 | $0.00388 |
| Haiku 4.5 | $0.00015 | $0.00194 |
Grade A, and why
tooluniverse-self-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Self-Review: Understand the Target, Then Review
Review the actual work the user means against the goal it was meant to satisfy. Default to a concise qualitative assessment. Scoring and the full Qworld Recursive Expansion Tree (RET) are opt-in.
Non-Negotiable Rules
- Do not confuse the evaluation request with the evaluated task. In requests such as "eval current work", that sentence is an instruction to review. The task being judged is the preceding user goal; the work is the current result, implementation, draft, plan, or progress.
- Do not equate
evalwith scoring.Eval,evaluate,review,assess, andcheckmean qualitative review unless the user explicitly asks for a score, grade, rating, points, weighted rubric, Qworld, RET, or a numeric scale. - Do not invent work to review. Inspect the conversation and available artifacts. If evidence is unavailable, say what could not be verified.
- Do not expose process by default. Keep scenario expansion, perspective generation, and rubric construction internal unless the user asked for those artifacts.
- Review against the user's goal, not a generic quality template. Derive the relevant checks from the request, stated constraints, acceptance criteria, and risks.
Resolve the Review Target
Separate three objects before reviewing:
- Evaluation instruction: what the user is asking now (for example, "review this").
- Original goal: the request, problem, or acceptance criteria the work should satisfy.
- Work product: the answer, code, files, diff, plan, analysis, or current progress to examine.
Resolve the work product in this order:
- An explicitly named file, answer, commit, diff, section, or artifact.
- Pasted or attached content in the current message.
- The current repository implementation or working-tree diff when the conversation is about code changes.
- The most recent assistant-produced deliverable relevant to the preceding user goal.
- The current plan or partial progress when the task is still underway.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 160 lines · 152 tokens per session scan A a80f3e386099
tooluniverse-self-review is a skill published in the GitHub repository mims-harvard/ToolUniverse (1,744 stars, last pushed yesterday), licensed Apache-2.0. It adds 152 tokens to every session and 1,942 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
intake
Inspect configured Sources and propose evidence-backed Backlog work.
team-lead
Run a goal as a team when you can also do the work yourself: decide what you keep, dispatch the rest, and keep the status board honest. The delta over goal-conductor, which carries the dispatch, patrol and acceptance procedure this one points at. Load it when you are handed a goal, not a task.
style-refresh
Refresh CocoStyle conventions from project evidence.
style-show
Show CocoStyle conventions for the current project.
product-management
Product management expertise for product strategy, roadmap planning, feature prioritization (RICE, ICE, MoSCoW), customer research, A/B testing, product analytics, and product-market fit. Use when building product roadmaps, prioritizing features, or defining product strategy.
yak-worktree-workflow
Use when starting work on a yak - sets up an isolated git worktree, reads yak context, and guides the full cycle from claiming through merge and cleanup.