skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cad-to-data/Gen Agent Trust Hub
cad-to-data
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted architectural files (IFC, RVT, DWG, DGN) to extract properties and metadata, creating a surface for indirect prompt injection if source files contain malicious instructions. Ingestion points: Processing of CAD/BIM files as defined in instructions.md. Boundary markers: Absent. Capability inventory: Subprocess execution and filesystem access. Sanitization: Not defined.
- [COMMAND_EXECUTION]: The instructions specify that the agent should use subprocess.run() to invoke format-specific CLI converters for CAD processing.
Audit Metadata