iczn
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts
scripts/fetch_article.pyandscripts/sync.pyperform network requests tocode.iczn.org. These requests are used to fetch the official letter of the law for specific articles and to detect when the upstream Code has been amended by the Commission. The domain is the official repository for the International Code of Zoological Nomenclature and is the primary source for the skill's functionality. - [COMMAND_EXECUTION]: The skill provides four utility scripts (
explain.py,fetch_article.py,validate_name.py,sync.py) and provides instructions for the agent to execute them locally. These scripts use only the Python standard library and perform routine taxonomic data processing and rule lookups. - [INDIRECT_PROMPT_INJECTION]: The
validate_name.pyscript processes user-supplied name strings and CSV files, creating a surface for indirect injection if a user provides a maliciously crafted name string. - Ingestion points: Command-line arguments and CSV files processed by
validate_name.py. - Boundary markers: Absent.
- Capability inventory: Regular expression matching, string manipulation, and stdout printing. No subprocess calls or network sends are performed using the ingested data.
- Sanitization: The script uses the standard library
csvmodule for structured data parsing.
Audit Metadata