notis-apps
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the use of the
notiscommand-line interface throughnpx --package @notis_ai/cli@latest -- notis. This allows the agent to execute a remotely fetched package to manage space operations and deployments. - [DYNAMIC_EXECUTION]: The platform supports a
cloudComputer: 'shell'capability which allows the agent to run arbitrary shell commands and upload files to a viewer's cloud environment. The documentation specifies that this functionality is gated by a portal prompt for user approval and is limited to the specific code allowed by the viewer. - [EXTERNAL_DOWNLOADS]: The skill relies on the
@notis/sdkand@notis_ai/clipackages, which are downloaded from external registries during the build and execution processes. - [INDIRECT_PROMPT_INJECTION]: The skill's architecture involves rendering views that process data from potentially untrusted database records and user-authored source code, creating a surface for indirect prompt injection.
- Ingestion points: View parameters, database records fetched via
useShownanduseActionQuery, and pulled source files (SKILL.md, references/views.md). - Boundary markers: Isolation is provided via Shadow DOM in the portal host and a read-only rendering environment for automated checks (references/architecture.md, references/reading.md).
- Capability inventory: The skill can execute shell commands, write files to the cloud computer, and perform network-based rendering of views (references/sdk.md, references/reading.md).
- Sanitization: The instructions include best practices such as validating schemas with discovery tools and keeping credentials out of commands and screenshots (references/design.md, references/sdk.md).
Audit Metadata