routeros-iot
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents features such as MQTT 'on-message' scripts and Bluetooth advertisement reporting that process data from external, potentially untrusted sources.
- Ingestion points: External data enters through MQTT subscriptions (
/iot/mqtt/subscriptions), Bluetooth scanner advertisement reports (/iot/bluetooth/scanners/advertisements), and LoRa traffic logs (/iot/lora/traffic). - Boundary markers: Boundary markers or explicit warnings to ignore embedded instructions are generally absent in the provided example scripts; data is often directly interpolated into JSON structures or log entries.
- Capability inventory: The documented RouterOS environment allows scripts to perform network operations (
/tool fetch), send emails (/tool e-mail/send), and execute system commands. - Sanitization: Sanitization or filtering of external content is minimal in the provided examples, relying on the user to implement secure parsing for specific use cases.
- [EXTERNAL_DOWNLOADS]: The documentation references external tools and packages necessary for specific hardware configurations.
- Mentions the installation of the
tg-lrx2-utilsPython package from PyPI for encoding LoRaWAN downlink commands inreferences/guides/internet-of-things/lora/user-guides/tg-lr-setup-guide.md. - References various firmware and decoder assets hosted on MikroTik's official domains or localized paths.
Audit Metadata