ecology-skills
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes scripts that interact with well-known biodiversity data services to retrieve species occurrence and assessment data.
- Evidence: Requests targeting
api.gbif.org(GBIF),api.inaturalist.org(iNaturalist), andapiv3.iucnredlist.org(IUCN Red List). - Analysis: These interactions are fundamental to the skill's purpose. The targeted services are established, well-known providers in the scientific community.
- [COMMAND_EXECUTION]: The
species-distribution-guide/SKILL.mdfile provides a function to run the MaxEnt (Maximum Entropy) modeling tool using Java. - Evidence: Use of
subprocess.run(["java", "-jar", "maxent.jar", ...])to execute the modeling software. - Analysis: This is a standard method for integrating this widely-used ecological modeling tool into Python workflows. The use of a list for command arguments prevents shell injection vulnerabilities.
- [SAFE]: The skill correctly manages sensitive information by retrieving API tokens from the execution environment rather than hardcoding them.
- Evidence:
api_token = os.environ["IUCN_API_TOKEN"]in the IUCN assessment script. - Analysis: This is a recommended security practice for handling authentication credentials.
Audit Metadata