agentic-ecology-bioacoustics

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches audio data from remote URIs (including services like Xeno-Canto) to support vector-based search and media preview generation. This is a documented core feature enabling researchers to bootstrap detectors from known audio examples.
  • [INDIRECT_PROMPT_INJECTION]: The skill functions as a data processing pipeline for untrusted audio recordings and remote snippets, presenting a surface for indirect injection if metadata or binary content were manipulated to influence agent behavior.
    • Ingestion points: User-specified audio directories in create_and_populate_db and remote audio URIs in the search and get_media_stream methods.
    • Boundary markers: Absent; audio data is processed directly by ML models for embedding and visualization without explicit textual delimiters.
    • Capability inventory: The skill performs file system operations (creating databases, writing to a spectrogram cache), reads local audio files, and executes network requests to fetch query audio.
    • Sanitization: The skill sanitizes relative file paths when generating dataset names and uses proper URL encoding for the web application's media endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 06:37 PM
Security Audit — agent-trust-hub — agentic-ecology-bioacoustics