cwcli
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the 'caffeinated-whale-cli' package directly from the PyPI registry using the 'uvx' utility. This results in the execution of third-party code in the local environment that does not originate from a recognized trusted vendor.
- [PERSISTENCE]: The 'setup' verb installs a 'SessionStart' hook into AI agent harnesses such as Claude Code, Codex, and OpenCode. This modifies the agent's initialization process to automatically execute context-gathering commands in every subsequent session.
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through 'uvx' and 'cwcli' to perform lifecycle management on Docker containers, run database migrations, and manage local application benches.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from local development environments which could serve as an attack surface for indirect instructions.
- Ingestion points: Docker container metadata, status reports, and bench application lists are ingested into the agent context via 'SKILL.md'.
- Boundary markers: No specific delimiters or safety instructions are defined to separate tool output from instructions.
- Capability inventory: Provides the ability to start, stop, and remove Docker containers and sites, as well as execute tests and migrations.
- Sanitization: The skill relies on the 'cwcli' tool's TOON format for structured data but lacks additional sanitization to prevent the agent from interpreting output as instructions.
Audit Metadata