terra-streaming

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation references official software development kits (SDKs) and libraries for various platforms including Android (co.tryterra:terra-rtandroid), iOS (TerraRTiOS), React Native (react-native-terra-rt-react), and Flutter (terra_flutter_rt). All downloads target legitimate vendor-owned repositories or official package registries.
  • [COMMAND_EXECUTION]: The skill advises the use of the Terra CLI tool (terra) for managing API references and integration settings. It provides standard installation commands via Homebrew (brew install tryterra/tap/terra) and NPM (npm install -g @tryterra/cli).
  • [INDIRECT_PROMPT_INJECTION]: The skill describes the ingestion of live biometric data (heart rate, movement, location) which represents a theoretical surface for indirect prompt injection if the resulting data is subsequently processed by an agent without sanitization.
  • Ingestion points: SDK updateHandler callbacks and backend websocket DISPATCH payloads.
  • Boundary markers: Data is delivered in structured JSON payloads using specific opcodes and fields.
  • Capability inventory: The documentation focuses on data visualization and backend processing; no dangerous shell execution or system-writing capabilities are linked to the data ingestion.
  • Sanitization: Biometric data is typically constrained to numeric scalar values (val) or arrays of doubles (d), which limits the potential for complex instruction injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 09:03 AM
Security Audit — agent-trust-hub — terra-streaming