skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/4d-simulation/Gen Agent Trust Hub
4d-simulation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process project data from external files, which creates a surface for indirect prompt injection attacks where malicious instructions could be embedded in the data.
- Ingestion points: Data is gathered from user-provided files (CSV, Excel, JSON) or direct parameters as specified in
instructions.md. - Boundary markers: The processing logic in
SKILL.mddoes not implement explicit delimiters or boundary markers to differentiate between data and potentially executable natural language instructions. - Capability inventory: The skill has file system write capabilities via the
export_4d_schedulefunction inSKILL.mdwhich uses theopenpyxlengine. - Sanitization: Although
instructions.mdcontains a directive to "Validate inputs before processing," there is no specific implementation of sanitization or escaping for untrusted content within the provided Python code snippets.
Audit Metadata