skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/change-order-analysis/Gen Agent Trust Hub
change-order-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The ChangeOrderPredictor.load_models method uses joblib.load() to restore model state from a file path. Because joblib uses Python's pickle module for serialization, it is susceptible to arbitrary code execution if an untrusted or malicious file is provided at the specified path.
- [COMMAND_EXECUTION]: The skill performs multiple filesystem write operations: the ChangeOrderAnalyzer.generate_report method uses pandas.ExcelWriter with the openpyxl engine to write project data to an Excel file at a user-specified path, and the ChangeOrderPredictor.save_models method uses joblib.dump() to save serialized model data.
Audit Metadata