routeros-zerotier
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documentation follows security best practices for network configuration. It utilizes environment variables for handling ZeroTier API tokens ($ZT_TOKEN) in shell commands, avoiding hardcoded credentials. It includes explicit warnings regarding the sensitivity of ZeroTier identity material (prefixes and identities). All external references and downloads target official or well-known service providers, including official MikroTik repositories (download.mikrotik.com) and ZeroTier's infrastructure. The RouterOS commands provided are standard for the advertised functionality of managing ZeroTier instances, interfaces, and controllers.
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes surfaces where external data is ingested into the agent context via API interactions. * Ingestion points: Data is fetched from ZeroTier Central API endpoints (e.g., api.zerotier.com/api/v1/network/$NWID/member) as described in references/zerotier-central.md. * Boundary markers: Not explicitly defined in the instructions for the handling of API data. * Capability inventory: The skill provides commands for RouterOS interface management, firewall list integration, and controller configuration in SKILL.md and references/zerotier-controller.md. * Sanitization: No explicit sanitization or validation of external API-returned JSON data is mentioned in the workflow.
Audit Metadata