routeros-iot

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents features such as MQTT 'on-message' scripts and Bluetooth advertisement reporting that process data from external, potentially untrusted sources.
  • Ingestion points: External data enters through MQTT subscriptions (/iot/mqtt/subscriptions), Bluetooth scanner advertisement reports (/iot/bluetooth/scanners/advertisements), and LoRa traffic logs (/iot/lora/traffic).
  • Boundary markers: Boundary markers or explicit warnings to ignore embedded instructions are generally absent in the provided example scripts; data is often directly interpolated into JSON structures or log entries.
  • Capability inventory: The documented RouterOS environment allows scripts to perform network operations (/tool fetch), send emails (/tool e-mail/send), and execute system commands.
  • Sanitization: Sanitization or filtering of external content is minimal in the provided examples, relying on the user to implement secure parsing for specific use cases.
  • [EXTERNAL_DOWNLOADS]: The documentation references external tools and packages necessary for specific hardware configurations.
  • Mentions the installation of the tg-lrx2-utils Python package from PyPI for encoding LoRaWAN downlink commands in references/guides/internet-of-things/lora/user-guides/tg-lr-setup-guide.md.
  • References various firmware and decoder assets hosted on MikroTik's official domains or localized paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 04:40 PM