cawplan-plan-create
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to interact with thecawplanCLI, a vendor-specific tool for the CawPlan platform. It performs standard administrative tasks such as listing products, creating versions, and managing tickets.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from user-pasted OKRs and goals to generate ticket content, presenting a surface for indirect prompt injection.\n - Ingestion points: User-provided text in Workflow B is used to derive ticket summaries and remarks.\n
- Boundary markers: The skill does not define specific delimiters or isolation instructions for the untrusted input.\n
- Capability inventory: Capabilities include creating and updating tickets via the
cawplanCLI as seen inSKILL.md.\n - Sanitization: No automated sanitization is specified; however, the skill mandates a manual preview and explicit user confirmation before executing any write commands, which serves as a primary mitigation.
Audit Metadata