cawplan-knowledge
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
cawplanCLI tool to interact with datasets and documents, including commands for listing, searching, creating, and uploading data (SKILL.md). - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external documents.
- Ingestion points: Document content and fragments are retrieved and presented to the agent via
cawplan knowledge documents getandcawplan knowledge search(SKILL.md). - Boundary markers: The instructions do not define specific boundary markers or 'ignore' instructions to isolate the retrieved document content from the agent's logic.
- Capability inventory: The skill has write capabilities, including
cawplan knowledge datasets create,cawplan knowledge documents upload, andcawplan knowledge documents update, which could be abused if an injected prompt influences the agent's actions (SKILL.md). - Sanitization: There is no documentation regarding the sanitization or escaping of document content before it is processed by the agent.
Audit Metadata