epd-to-spec

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill's primary functionality is to generate specification text for construction materials. The workflow involves parsing material lists and Environmental Product Declaration (EPD) data to produce Markdown files. All requested capabilities are consistent with this stated purpose.
  • [COMMAND_EXECUTION]: The skill includes Bash in its allowed-tools list. The instructions describe using the agent's capabilities to organize and write specification files to the user's ~/Documents directory. No suspicious or dangerous shell commands are included in the skill's logic.
  • [EXTERNAL_DOWNLOADS]: The README provides installation instructions using git clone from the author's official GitHub repository (AlpacaLabsLLC/skills-for-architects). This is a standard and transparent distribution method for this vendor.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from user descriptions and external spreadsheets.
  • Ingestion points: Material lists, verbal project descriptions, and EPD data retrieved from Google Sheets via MCP tools (SKILL.md).
  • Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore instructions embedded within the processed EPD data or material descriptions.
  • Capability inventory: The skill has Write, Edit, and Bash permissions used to create specification documents in the local filesystem (SKILL.md).
  • Sanitization: There is no evidence of input validation or sanitization before the external content is interpolated into the generated specification sections.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 11:58 AM
Security Audit — agent-trust-hub — epd-to-spec