cawplan-my-work
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the CawPlan API via the cawplan CLI tool, creating a surface for potential indirect prompt injection attacks where malicious content in ticket data could influence the agent's behavior.
- Ingestion points: Ticket titles, types, priorities, status names, history transition fields, progress comments, and linked PR/commit titles/URLs (retrieved in SKILL.md through
cawplan todos,cawplan tickets search, andcawplan tickets historycommands). - Boundary markers: The skill instructions do not specify the use of delimiters or provide explicit warnings to the agent to ignore instructions embedded within the fetched ticket content.
- Capability inventory: The skill utilizes the
Bashtool to execute CLI commands (cawplan) and processes the resulting output to generate reports and summaries. - Sanitization: No sanitization, validation, or escaping routines are mentioned for the content retrieved from the external API before it is processed or presented to the user.
Audit Metadata