hap-cli-data-query
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No evidence of obfuscation, data exfiltration, or malicious intent was found in the instructions or code examples. All operations are local CLI calls related to the tool's primary purpose.
- [COMMAND_EXECUTION]: The skill utilizes the
hapCLI for legitimate data operations, includingworksheet record list,worksheet record pivot, andworksheet fields. The usage follows standard patterns for agent-based tool interaction. - [PROMPT_INJECTION]: Indirect Prompt Injection Surface:
- Ingestion points: Untrusted data enters the context through the output of
hap worksheet record listandrecord pivotcommands as documented inSKILL.md. - Boundary markers: None are specified in the instructions for separating queried record data from agent instructions.
- Capability inventory: The skill uses
hapCLI for reading records and references writing capabilities in its description. - Sanitization: There are no instructions for sanitizing or validating external record content before the agent processes it.
Audit Metadata