skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/budget-variance-analyzer/Gen Agent Trust Hub
budget-variance-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process project data from external sources such as CSV, Excel, and JSON files. This creates an attack surface where maliciously crafted data could attempt to manipulate the agent's behavior.
- Ingestion points: User-provided data files and project parameters processed by
BudgetVarianceAnalyzerinSKILL.md. - Boundary markers: Absent. There are no explicit delimiters or "ignore instructions" markers used when processing external data.
- Capability inventory: Filesystem write access via the
export_variance_reportmethod inSKILL.mdusingpandas.ExcelWriter. - Sanitization: Absent. The provided logic performs calculations but does not implement strict schema validation or sanitization for input data.
- [COMMAND_EXECUTION]: The skill requires a
python3environment and includes Python implementation code intended to be executed for data processing and report generation. - [EXTERNAL_DOWNLOADS]: The skill implementation relies on the external Python packages
pandasandopenpyxlfor data handling and Excel file operations.
Audit Metadata