terra-lab-reports
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official vendor tooling, specifically the
@tryterra/clivianpmand theterraCLI via a custom Homebrew tap. These resources are provided directly by the vendor for integration management. - [INDIRECT_PROMPT_INJECTION]: The skill describes an API designed to process untrusted external files (PDFs and images) which represents an attack surface for indirect prompt injection.
- Ingestion points: The
POST /v2/lab-reportsendpoint accepts various image and document formats for clinical data extraction (SKILL.md). - Boundary markers: The instructions do not provide explicit delimiters or prompts to isolate extracted text from system instructions.
- Capability inventory: The skill utilizes network access to vendor endpoints and command execution through the
terraCLI (SKILL.md). - Sanitization: There are no specific instructions for sanitizing or validating the extracted biomarker data to prevent instruction injection.
Audit Metadata