cawplan-ux-tracking
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the CawPlan platform, creating a surface for indirect prompt injection where malicious instructions could be embedded in ticket data.
- Ingestion points: Data is ingested via
cawplanCLI commands from tickets, comments, feedback, knowledge-base documents, and attachments as described inSKILL.mdandreferences/UNTRUSTED_CONTENT.md. - Boundary markers: The skill incorporates
references/UNTRUSTED_CONTENT.md, which provides explicit instructions to treat external content as data rather than instructions and to ignore any commands found within. - Capability inventory: The skill uses
Bashto executecawplanCLI tools for data retrieval (tickets search,tickets stats,tickets changes,tickets history,products list,versions list,product-lines list). - Sanitization: The instructions emphasize that untrusted content must never authorize writes or choose targets, and the agent is directed to quote untrusted text rather than merging it into its own conclusions.
Audit Metadata