| Name | Risk Level | Details / Hazards | Measures for Risk Reduction |
|---|
| Executing arbitrary terminal commands |
Highest |
An agent (or the Terminal panel itself) can run any command your OS user can - install/remove software, change system settings, exfiltrate data, or destroy files - with the same permissions you're logged in with. |
Review commands before they run rather than looking away; avoid running Roject under an admin/root account; keep high-value credentials (cloud CLI tokens, deploy keys) out of reach where possible; use a disposable/sandboxed environment (VM, container, separate user account) for higher-risk work. |
| Reading, writing, or deleting files |
Highest |
An agent with file access can overwrite or delete anything in the project it can reach - including files it wasn't asked to touch - and can read sensitive files (credentials, keys, personal data) sitting in that folder. |
Keep the project under version control and commit before large changes; don't store secrets/credentials inside a project folder a Rojo operates in; scope the project directory to only what's needed. |
| Destructive git operations |
High |
An agent asked to "clean up" or "fix" a repository can run force-pushes, hard resets, or history rewrites that discard uncommitted or even already-pushed work. |
Ask an agent to explain a destructive git operation before running it; keep independent backups/remotes; avoid granting force-push access to shared or production branches. |
| Credential & secret exposure |
High |
Secrets can leak via terminal output, shell history, log files, or an agent quoting them back into generated text, commit messages, or chat history. |
Use a proper secret manager instead of plaintext files in the project; rotate any credential that may have been exposed; review generated output (commit messages, docs) for accidental inclusion before it's shared or committed. |
| Name | Risk Level | Details / Hazards | Measures for Risk Reduction |
|---|
| Prompt injection via untrusted text |
High |
Any text an agent reads - a file, a web page, a tool's output, even a filename - can contain instructions disguised as content. An agent that treats file content as trustworthy may follow hidden instructions instead of yours. |
Treat text pulled from outside your own direct input as potentially adversarial, especially in unfamiliar projects; review what an agent read immediately before it takes an unexpected action; don't have agents process untrusted external content unsupervised. |
| Hazard sessions (a session gone wrong) |
High |
A session can be badly initialized or take a strange turn partway through: acting overconfident, making repeated errors, ignoring your instructions, failing to use tools or context correctly, or otherwise behaving unlike its normal pattern. |
Restart the session immediately once you notice this pattern, rather than continuing it or trying to talk it back on track; don't approve actions from a session already showing these signs. |
| Runaway loops & resource/cost use |
Medium |
A stuck or misbehaving session can loop, retry excessively, or keep making tool calls - consuming local resources and, for metered third-party AI providers, real money. |
Watch active sessions periodically rather than leaving them fully unattended for long stretches; restart hazard sessions immediately (see above); check your provider's usage/billing if you use a metered API key. |
| Untested instructable components |
Medium |
Components, workflows, or configurations shipped with Roject that expose instructable/actionable content to agents or LLMs (prompt templates, tool configs, workspace actions) are blueprints, not verified-safe defaults - they haven't been adversarially tested. |
Read and understand any such component before relying on it; don't grant it broad access until you've reviewed what it actually does. |
| Name | Risk Level | Details / Hazards | Measures for Risk Reduction |
|---|
| Opening ports / firewall exceptions |
High |
Features like the Static Server panel, the video call panel, or the experimental tunnel.rokojori.com service open network ports or ask for firewall exceptions to work, which can expose a local service beyond what you intended - to your whole LAN, or in some configurations, the internet. |
Only open the minimum needed; close/stop servers and revoke firewall rules when you're done; avoid running exposed services on networks you don't control (public Wi-Fi). |
| Directory listing exposure |
Medium |
The Static Server panel's directory listing serves every file under the chosen root to anyone who can reach the port, including files you didn't mean to publish. |
Point it only at directories you're comfortable exposing entirely; turn off directory listing if you don't need it; stop the server when you're not actively using it. |
| Experimental remote access (tunnel.rokojori.com) |
High |
This experimental, invite-only feature lets a locally hosted model be reached remotely, which by design exposes a local capability outside your machine. |
Only enable this if you understand what it exposes; treat it as experimental and not yet hardened for general use, per its invite-only status. |
| Video call IP exposure |
Low |
Direct (non-relay) WebRTC calls can reveal your IP address to the person you're calling. |
Use the Force Relay option in the video call panel's settings if you don't want to share your direct IP with a call peer. |
| Name | Risk Level | Details / Hazards | Measures for Risk Reduction |
|---|
| Orphaned processes |
Medium |
Terminal sessions, static servers, spawned agent subprocesses, or tools an agent launched can keep running after the panel, session, or even the app itself closes - continuing to hold ports, use resources, or in rare cases keep acting. This can originate from Roject itself or from an agent. |
Periodically check your system's process/task list for anything Roject-related that should have stopped; manually end anything left running. |
| Unresponsive or crashed agents |
Medium |
The programs behind a Rojo (a local model process, a spawned CLI, a remote API connection) are external software and can crash, hang, or stop responding to Roject's own instructions - including its attempts to stop them. Even closing the panel or the whole app is not guaranteed to stop an already-misbehaving external process. |
If closing the panel/app doesn't stop something, check your system's process list directly and end it manually; treat a consistently unresponsive Rojo as a sign to restart the underlying provider/process, not just the chat session. |
| Name | Risk Level | Details / Hazards | Measures for Risk Reduction |
|---|
| Data sent to third-party AI providers |
Medium |
Whatever an agent reads to do its job - prompts, file contents, project structure - is sent to whatever model/provider you've configured (your own API key, a local model, or a local CLI), under that provider's own data handling terms. |
Don't point a Rojo at projects containing data you're not willing to send to your configured provider; review that provider's own data/privacy terms; use a local model to keep data off third-party servers entirely. |
| Third-party tool behavior & availability |
Low |
Third-party AI providers/models can change behavior, pricing, or availability at any time, and bundled tools (like the Claude Code CLI) can self-update in ways that occasionally leave them in a broken state. |
Keep track of which provider/model a project depends on; if a Rojo suddenly behaves very differently or stops working, check whether the underlying provider or tool changed before assuming your project changed. |
This page does not describe every possible risk, and following the
measures above does not eliminate risk - it reduces it. You are
responsible for evaluating whether a given risk is acceptable for your
own situation, data, and systems, and for deciding whether you
understand a risk well enough to take it. When something above is
unclear, or you're not sure whether a specific action is safe, the
safer choice is not to take it until you are sure.