iczn

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts scripts/fetch_article.py and scripts/sync.py perform network requests to code.iczn.org. These requests are used to fetch the official letter of the law for specific articles and to detect when the upstream Code has been amended by the Commission. The domain is the official repository for the International Code of Zoological Nomenclature and is the primary source for the skill's functionality.
  • [COMMAND_EXECUTION]: The skill provides four utility scripts (explain.py, fetch_article.py, validate_name.py, sync.py) and provides instructions for the agent to execute them locally. These scripts use only the Python standard library and perform routine taxonomic data processing and rule lookups.
  • [INDIRECT_PROMPT_INJECTION]: The validate_name.py script processes user-supplied name strings and CSV files, creating a surface for indirect injection if a user provides a maliciously crafted name string.
  • Ingestion points: Command-line arguments and CSV files processed by validate_name.py.
  • Boundary markers: Absent.
  • Capability inventory: Regular expression matching, string manipulation, and stdout printing. No subprocess calls or network sends are performed using the ingested data.
  • Sanitization: The script uses the standard library csv module for structured data parsing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 07:19 PM
Security Audit — agent-trust-hub — iczn