ecology-skills

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes scripts that interact with well-known biodiversity data services to retrieve species occurrence and assessment data.
  • Evidence: Requests targeting api.gbif.org (GBIF), api.inaturalist.org (iNaturalist), and apiv3.iucnredlist.org (IUCN Red List).
  • Analysis: These interactions are fundamental to the skill's purpose. The targeted services are established, well-known providers in the scientific community.
  • [COMMAND_EXECUTION]: The species-distribution-guide/SKILL.md file provides a function to run the MaxEnt (Maximum Entropy) modeling tool using Java.
  • Evidence: Use of subprocess.run(["java", "-jar", "maxent.jar", ...]) to execute the modeling software.
  • Analysis: This is a standard method for integrating this widely-used ecological modeling tool into Python workflows. The use of a list for command arguments prevents shell injection vulnerabilities.
  • [SAFE]: The skill correctly manages sensitive information by retrieving API tokens from the execution environment rather than hardcoding them.
  • Evidence: api_token = os.environ["IUCN_API_TOKEN"] in the IUCN assessment script.
  • Analysis: This is a recommended security practice for handling authentication credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 09:57 PM
Security Audit — agent-trust-hub — ecology-skills