notis-apps

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the use of the notis command-line interface through npx --package @notis_ai/cli@latest -- notis. This allows the agent to execute a remotely fetched package to manage space operations and deployments.
  • [DYNAMIC_EXECUTION]: The platform supports a cloudComputer: 'shell' capability which allows the agent to run arbitrary shell commands and upload files to a viewer's cloud environment. The documentation specifies that this functionality is gated by a portal prompt for user approval and is limited to the specific code allowed by the viewer.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the @notis/sdk and @notis_ai/cli packages, which are downloaded from external registries during the build and execution processes.
  • [INDIRECT_PROMPT_INJECTION]: The skill's architecture involves rendering views that process data from potentially untrusted database records and user-authored source code, creating a surface for indirect prompt injection.
  • Ingestion points: View parameters, database records fetched via useShown and useActionQuery, and pulled source files (SKILL.md, references/views.md).
  • Boundary markers: Isolation is provided via Shadow DOM in the portal host and a read-only rendering environment for automated checks (references/architecture.md, references/reading.md).
  • Capability inventory: The skill can execute shell commands, write files to the cloud computer, and perform network-based rendering of views (references/sdk.md, references/reading.md).
  • Sanitization: The instructions include best practices such as validating schemas with discovery tools and keeping credentials out of commands and screenshots (references/design.md, references/sdk.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 06:59 PM