terra-streaming
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references official software development kits (SDKs) and libraries for various platforms including Android (co.tryterra:terra-rtandroid), iOS (TerraRTiOS), React Native (react-native-terra-rt-react), and Flutter (terra_flutter_rt). All downloads target legitimate vendor-owned repositories or official package registries.
- [COMMAND_EXECUTION]: The skill advises the use of the Terra CLI tool (
terra) for managing API references and integration settings. It provides standard installation commands via Homebrew (brew install tryterra/tap/terra) and NPM (npm install -g @tryterra/cli). - [INDIRECT_PROMPT_INJECTION]: The skill describes the ingestion of live biometric data (heart rate, movement, location) which represents a theoretical surface for indirect prompt injection if the resulting data is subsequently processed by an agent without sanitization.
- Ingestion points: SDK
updateHandlercallbacks and backend websocketDISPATCHpayloads. - Boundary markers: Data is delivered in structured JSON payloads using specific opcodes and fields.
- Capability inventory: The documentation focuses on data visualization and backend processing; no dangerous shell execution or system-writing capabilities are linked to the data ingestion.
- Sanitization: Biometric data is typically constrained to numeric scalar values (
val) or arrays of doubles (d), which limits the potential for complex instruction injection.
Audit Metadata