cawplan-internal-qa-coding-session-test
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to runcawplanCLI commands to retrieve session metadata, member information, and full conversation transcripts. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external conversation data, which creates a surface for indirect prompt injection if the conversation contains instructions targeting the LLM.
- Ingestion points: Full conversation messages are retrieved via the
cawplan session conversationcommand as described inSKILL.md. - Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between the conversation content and the agent's summarization instructions.
- Capability inventory: The skill uses the
Bashtool to execute local CLI commands, which is its primary method of data acquisition. - Sanitization: No validation or sanitization is performed on the raw text retrieved from the conversation messages before it is processed for summarization.
Audit Metadata