cawplan-internal-qa-coding-session-test
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via the Bash tool to interact with the cawplan CLI utility.
- Evidence: Multiple cawplan commands are used in SKILL.md, including
cawplan session members,cawplan session my-sessions, andcawplan session conversationto resolve users and fetch data. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes raw, untrusted conversation data from session logs.
- Ingestion points: Conversation messages are fetched into the agent's context in SKILL.md (Workflow Step 2) via the
cawplan session conversationcommand. - Boundary markers: Absent. The instructions do not use specific delimiters or "ignore instructions" warnings when processing the fetched message text.
- Capability inventory: The skill has access to the Bash tool, although its use is restricted to the cawplan vendor CLI in the instructions.
- Sanitization: Absent. The agent is directed to read through the messages directly to perform the summary generation reasoning step.
Audit Metadata