Prompts for security reviewers

I'm reviewing the Kowalah connector and plugin for approval in our
organisation. Read every page under https://docs.kowalah.com/security
and the checklist at
https://www.kowalah.com/resources/templates/ai-connector-security-review-checklist

Treat this as a vendor review as well as a connector review, because
Kowalah has its own backend. For every checklist item, tell me:
answered, partly answered or not answered; the answer in one or two
sentences; and the page you got it from. Don't fill gaps with
assumptions. List the unanswered items at the end as questions I should
put to Kowalah.

From the unanswered and partly answered items, draft a short
questionnaire to send to Kowalah. Group the questions under hosting and
sub-processors, data stored and retention, separation from other
customers, security evidence, model training, exit and deletion, and
support and incidents. Keep each question specific enough that a yes or
no isn't a complete answer.

This is the Kowalah plugin package. Review it as a security reviewer.
1. List every skill and summarise in one line what it tells the AI to do.
2. List every connector or server it configures, with the URL and how
   it authenticates.
3. Flag any instruction that sends data anywhere other than that
   server, asks the AI to bypass a user confirmation, or tells it to
   act without the user asking.
4. Flag any script or executable file.
Quote the file and line for anything you flag.

Here are two versions of the Kowalah plugin. Compare them and tell me
what changed: new or removed skills, changed instructions, and any
change to the connector address or authentication. Tell me whether any
change affects what we approved.

List every Kowalah tool available to you in this chat. For each one give
its name, whether it reads or writes, what data it returns or changes,
and any role or permission limits it describes. Then tell me separately:
can any tool delete records, send email or messages, or reach a system
other than Kowalah?

Split the Kowalah tools into read-only and write. For each write tool,
tell me which roles can use it, whether it asks the user to confirm
before it changes anything, and what record it creates or changes. Mark
any write that changes data outside our own organisation.

Using Kowalah, try to find a project, opportunity or person from an
organisation other than ours. Tell me exactly what you tried and what
came back.

Using https://docs.kowalah.com/security/data-flow and
https://docs.kowalah.com/security/platform-architecture, draw a data
flow diagram for the Kowalah connector: the user, our AI platform, the
Kowalah connector, Kowalah's backend and its sub-processors. Label what
data moves on each arrow, and mark anything that is personal data or
could be special category data. Tell me where data leaves the UK, if
anywhere.

From Kowalah's security docs, explain how a user signs in to the
Kowalah connector, how their email domain decides which organisation
they join, and how roles limit what they see. Then explain what happens
when someone leaves: how their access to Kowalah is removed, and what we
need to do in our AI platform's admin settings as well.

Act as our data protection officer. Using Kowalah's security docs and
sub-processor list, screen whether the Kowalah connector needs a full
Data Protection Impact Assessment under UK GDPR. Cover the categories of
personal data involved, the lawful basis we'd likely rely on,
retention, international transfers and who the sub-processors are. Say
clearly which points the docs answer and which we need to confirm with
Kowalah.

Draft a pilot plan for the Kowalah connector and plugin. One team of
around 20 people for four weeks. Include who gets access and how we
restrict it in our AI platform's admin settings, which write actions are
in scope, what we log and who reviews it, and exit criteria: usage,
accuracy checks, no incidents and a clean log review. End with what
evidence we'd need to widen it to the whole organisation.

Pull everything from this conversation into a one-page approval
recommendation for our decision owner: what Kowalah is, which review
type applies and why, the scopes and write actions, the data flow,
open risks with a rating each, conditions of approval, and the pilot
plan. Mark anything still waiting on an answer from Kowalah.