cawplan-qa-commit
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Uses the cawplan CLI tool to collect, assign, and upload QA session data. Commands are executed within a dedicated temporary directory to prevent repository contamination and ensure process isolation. No suspicious command strings or unauthorized system modifications were detected.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from cursor.com via the CLI tool to populate reports. This is an expected operation for the vendor's ecosystem and is documented as requiring network access.
- [DATA_EXFILTRATION]: Facilitates the upload of QA reports to a backend service. This data transfer is the primary purpose of the skill and is governed by a 'Review Content Contract' that requires the agent to present a summary of the data to the user for verification before the upload command is executed.
- [SAFE]: Analysis found no evidence of prompt injection, obfuscation, or persistence mechanisms. The skill demonstrates defensive coding patterns, such as resolving and validating date arguments before passing them to shell commands.
Audit Metadata