iot-firmware
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download the@claude-flow/plugin-iot-cognitumpackage from the npm registry at runtime. - [COMMAND_EXECUTION]: Executes shell commands via
npxto perform firmware deployment, advancement, and rollback operations across device fleets. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection through the interpolation of user-provided data into shell commands.
- Ingestion points: Arguments such as
FLEET_ID,VERSION, andROLLOUT_IDare provided by the user and used directly in command execution. - Boundary markers: There are no boundary markers or instructions to isolate user input from the command syntax.
- Capability inventory: The skill utilizes the Bash tool (via
npx) to execute system-level commands. - Sanitization: No sanitization or validation logic is defined within the skill instructions to process external inputs before they are used in the shell environment.
Audit Metadata