epd-to-spec
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary functionality is to generate specification text for construction materials. The workflow involves parsing material lists and Environmental Product Declaration (EPD) data to produce Markdown files. All requested capabilities are consistent with this stated purpose.
- [COMMAND_EXECUTION]: The skill includes
Bashin itsallowed-toolslist. The instructions describe using the agent's capabilities to organize and write specification files to the user's~/Documentsdirectory. No suspicious or dangerous shell commands are included in the skill's logic. - [EXTERNAL_DOWNLOADS]: The README provides installation instructions using
git clonefrom the author's official GitHub repository (AlpacaLabsLLC/skills-for-architects). This is a standard and transparent distribution method for this vendor. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from user descriptions and external spreadsheets.
- Ingestion points: Material lists, verbal project descriptions, and EPD data retrieved from Google Sheets via MCP tools (
SKILL.md). - Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore instructions embedded within the processed EPD data or material descriptions.
- Capability inventory: The skill has
Write,Edit, andBashpermissions used to create specification documents in the local filesystem (SKILL.md). - Sanitization: There is no evidence of input validation or sanitization before the external content is interpolated into the generated specification sections.
Audit Metadata