cawplan-internal-qa-coding-humaninputs-test
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated messages and assistant responses fetched from session logs, which serves as a potential vector for indirect prompt injection. * Ingestion points: Log data containing human input is fetched in Step 2 via the cawplan CLI and stored in a temporary JSONL file. * Boundary markers: The workflow does not specify the use of clear delimiters or guardrail instructions to isolate the ingested content from the agent's core instructions. * Capability inventory: The skill is granted access to the Bash tool and performs automated batch processing of logs. * Sanitization: There is no evidence of input validation, filtering, or sanitization of the fetched strings before they are passed to the classification engine in Step 3.
Audit Metadata