skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/as-built-tracker/Gen Agent Trust Hub
as-built-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (CSV, Excel, JSON) through the
import_document_listmethod inSKILL.md. This data is stored in class instances and processed for summaries and reports. - Ingestion points:
AsBuiltTracker.import_document_listinSKILL.mdaccepts a pandas DataFrame which may contain untrusted data from user-uploaded files. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The skill has the capability to write files to the local filesystem via the
export_to_excelmethod. - Sanitization: The input data is not explicitly sanitized before being stored in
AsBuiltDocumentobjects or exported back to Excel, though it is primarily treated as data for structural tracking.
Audit Metadata