rota-decide
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a custom command
rota block decisionsin Step 7. This command is used to update managed blocks within project configuration files likeAGENTS.mdorCLAUDE.md, ensuring that documented decisions are integrated into the agent's operational context. This represents expected functionality for the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and conversations to update agent instructions, which presents a surface for potential indirect prompt injection.
- Ingestion points: Data is read from the active conversation,
.rota/KNOWLEDGE.md, and files within.rota/spikes/(referenced in SKILL.md Step 2 and source-prefill-modes.md). - Boundary markers: Step 5 of the skill (Confirmation Gate) requires the user to manually review the full draft and explicitly select "Write it" before any persistent changes are made.
- Capability inventory: The skill has the ability to write to
.rota/DECISIONS.md, modifyAGENTS.mdorCLAUDE.md, and execute therotashell command. - Sanitization: The skill relies on the user confirmation gate for validation rather than automated sanitization of the ingested content.
Audit Metadata