skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/bid-analysis-comparator/Gen Agent Trust Hub
bid-analysis-comparator
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill's implementation is consistent with its stated purpose of bid analysis and uses standard, non-obfuscated Python code.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted contractor bid data, which creates a potential surface for indirect prompt injection if an attacker includes instructions in bid descriptions.\n
- Ingestion points: Contractor bid data (names, qualifications, exclusions) provided via CSV, Excel, or text input.\n
- Boundary markers: No explicit delimiters or instruction-ignore warnings are implemented in the Python code in SKILL.md.\n
- Capability inventory: The skill has filesystem write access via pd.ExcelWriter to export comparison reports.\n
- Sanitization: The instructions.md file requires the agent to validate inputs before processing data.
Audit Metadata