rota-ship
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local environment to automate workflow tasks, creating a potential injection surface.\n
- Ingestion points: Data is ingested from
git log,git diff, and the contents of thedocs/directory during status checks and documentation updates (found inSKILL.mdanddocs-mode.md).\n - Boundary markers: The instructions do not define specific delimiters or prompt boundary markers to isolate ingested content from agent instructions.\n
- Capability inventory: The skill can perform sensitive actions such as opening PRs (
rota ship pr), merging branches (rota ship merge), closing issues (rota issues close), and modifying the file system (docs-mode.md).\n - Sanitization: All high-impact operations, including PR opening, merging, and issue closing, are defined as "manual gates," requiring human confirmation regardless of the agent's autonomy settings.\n- [DYNAMIC_EXECUTION]: The skill dynamically dispatches tasks to other specialized agents and tools.\n
- Evidence: The skill invokes the
rota-qaskill via theSkilltool and creates a "second-opinion" subagent using theAgenttool with a general-purpose model (sonnet).
Audit Metadata