terra-unified-api
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official vendor tools and libraries, including the
@tryterra/cliand theterra-apiNode.js SDK, to facilitate API integration and management.\n- [COMMAND_EXECUTION]: The instructions guide the agent in using theterraCLI to perform administrative tasks such as listing destinations, managing users, and replaying events for testing purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes a pattern for handlings3_payloadwebhooks where the agent may need to fetch and process data from a URL provided in the payload (event.url). This ingestion surface is secured by the skill's strong recommendation to perform HMAC signature verification on the raw request body before any processing or fetching occurs.\n - Ingestion points:
rules/webhooks-handle-informational-events.md(fetching content fromevent.url)\n - Boundary markers: The skill requires signature verification (
verifyTerraWebhookSignature) as a gate for all webhook processing\n - Capability inventory: Use of
terraCLI for integration administration; use offetchfor retrieving external payloads\n - Sanitization: Strict HMAC-SHA256 signature verification over the raw request body is recommended to ensure data integrity and authenticity.\n- [SAFE]: The skill explicitly promotes security best practices, including constant-time HMAC comparison and the use of raw request bytes for verification to prevent signature bypasses caused by middleware body-parsing.
Audit Metadata