cawplan-knowledge
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cawplanCLI via the Bash tool to perform operations such as listing datasets, searching documents, and uploading files. This is the intended functionality of the skill for the CawPlan service. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and presents untrusted data from knowledge base documents to the agent.
- Ingestion points: Data enters the context through
cawplan knowledge search(search fragments),cawplan knowledge documents get(full document or specific sections), andcawplan knowledge documents get --outline(structural previews) inSKILL.md. - Boundary markers: The instructions do not define delimiters or warnings to ignore instructions embedded within the retrieved content.
- Capability inventory: The skill is allowed to use the
Bashtool to execute CLI commands, including file uploads and searches. - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the documents before it is processed by the agent.
Audit Metadata