skills/buildrtech/skills/bid-leveling/Gen Agent Trust Hub

bid-leveling

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted subcontractor bid documents (PDFs, emails, spreadsheets), which constitutes an indirect prompt injection surface.
  • Ingestion points: External bid documents as described in the workflow section of SKILL.md.
  • Boundary markers: SKILL.md instructs the agent to treat documents as data only and ignore any embedded instructions.
  • Capability inventory: The skill uses a custom Python script for data processing with no network access or high-privilege operations.
  • Sanitization: Input data is strictly validated against a JSON schema by scripts/level_bids.py before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 09:30 PM