cawplan-support-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from external Google Sheets, creating a surface for indirect prompt injection where malicious content in the sheet could attempt to override agent instructions during validation or import steps.
- Ingestion points: Data is retrieved from a Google Spreadsheet via the
cawplanSupportReadRows_function inassets/CawPlanSupportMetrics.gs. - Boundary markers: The skill relies on a 'V1 contract boundary' and mandatory user approval for dry-runs as specified in
SKILL.md. - Capability inventory: The skill uses
Bashto executecawplan metrics ingestfor writing data to the CawPlan platform. - Sanitization: The implementation uses
cawplanSupportReadCount_to validate numeric values but lacks specific sanitization for string-based tags like 'assignee' or 'product_line'. - [DATA_EXFILTRATION]: The asset
assets/CawPlanSupportMetrics.gscontains a hardcoded Google Spreadsheet ID (1FyQ4v9sKM6hg9g3xsFC6OCa9uiuOvpSTLi2eS1NBerY). Accessing fixed external resources can lead to sensitive data exposure if the spreadsheet contains private information. The script also logs public download URLs for the generated JSON exports. - [COMMAND_EXECUTION]: The skill is configured with
allowed-tools: Bash, which is used to run CLI commands for authentication (cawplan auth login) and metric ingestion. This provides the agent with systemic capabilities to execute shell commands and perform network operations.
Audit Metadata