terra-mobile-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official vendor-maintained libraries and tools from standard package registries:
- Node.js:
@tryterra/cliandterra-reactvia NPM. - Android:
co.tryterra:terra-androidvia Maven Central. - Flutter:
terra_flutter_bridgevia Pub.dev. - iOS:
TerraiOSvia Swift Package Manager (GitHub). - [COMMAND_EXECUTION]: The documentation provides examples of using the
terraCLI for administrative tasks, such as managing environment data tokens and listing users. These commands are intended for development and integration management. The skill explicitly warns against printing sensitive credentials in logs when using commands that output auth tokens. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting untrusted data from third-party health sources (Apple Health, Samsung Health, Health Connect) into the agent's context via SDK getter methods like
getDailyandgetSleep. - Ingestion points: Data is retrieved via
TerraManager(Android/iOS),TerraFlutter(Flutter), orterra-react(React Native) functions. - Boundary markers: No specific delimiters or warnings for the agent are defined within the skill's instructions for handling the returned health data.
- Capability inventory: The skill includes the ability to write data to mobile health stores using
postActivity,postBody, andpostNutritionmethods, as well as managing the integration via theterraCLI. - Sanitization: The documentation does not specify sanitization procedures for the health data, though such data (numerical metrics and enums) typically poses a low risk for prompt injection compared to free-text inputs.
Audit Metadata