rota-vision
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web (via WebSearch/WebFetch in research.md) and project files (Step 2 in SKILL.md) to generate milestone plans. This creates a data flow from untrustworthy external sources to local command execution. 1. Ingestion points: research.md and project-level files like README.md. 2. Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from following instructions embedded in the external content. 3. Capability inventory: The skill utilizes the 'rota' CLI and 'jq' for data manipulation and storage. 4. Sanitization: There is no evidence of sanitization or validation of the fetched strings before they are incorporated into 'rota' command arguments.
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands to track and manage project vision. Evidence: Step 7 in SKILL.md details the use of 'rota milestone add', 'rota milestone put', and others, including pipes into 'jq'.
- [EXTERNAL_DOWNLOADS]: The skill performs automated web research to inform milestone decisions. Evidence: Step 4 in research.md triggers the use of 'WebSearch' and 'WebFetch' subagent tools.
Audit Metadata