terra-streaming
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Instructions in the documentation suggest installing the official Terra CLI by downloading a script from the vendor's domain and executing it directly in the shell.
- Evidence:
curl -fsSL https://cli.tryterra.co/install.sh | shin SKILL.md. - Evidence:
irm "https://cli.tryterra.co/install.ps1" | iexfor Windows environments in SKILL.md. - [EXTERNAL_DOWNLOADS]: The skill facilitates the cloning of example projects and the downloading of configuration data from official vendor repositories.
- Evidence: Fetching REST endpoints and protocol frames from
docs.tryterra.co. - Evidence: Cloning project templates using
terra examples clone. - [COMMAND_EXECUTION]: The skill utilizes a CLI tool to manage developer environments, list data tokens, and administer users.
- Evidence: Usage of
terra environments list,terra users list, andterra data-tokens createthroughout SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process real-time biometric telemetry (heart rate, ECG, location, etc.) received from external hardware sensors, which is an untrusted data source.
- Ingestion points: Biometric data arrives at the backend via websocket DISPATCH payloads in JSON format (SKILL.md, references/consumer-protocol.md).
- Boundary markers: No specific delimiters are defined as the broker passes sensor payloads opaquely.
- Capability inventory: The skill provides the logic for backends to consume and react to these data streams.
- Sanitization: Data is treated as raw telemetry; sanitization of this input for downstream use cases is the responsibility of the implementing developer.
Audit Metadata