skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-bid-analyzer/Gen Agent Trust Hub
cwicr-bid-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes standard, well-known Python libraries (pandas, numpy, openpyxl) for its core functionality of construction bid analysis and reporting.
- [INDIRECT_PROMPT_INJECTION]: The skill processes contractor bids from external file formats like CSV and Excel, which introduces a potential surface for indirect prompt injection.
- Ingestion points: Data is ingested via the analyze_bid method in SKILL.md from pd.DataFrame objects loaded from user-supplied files.
- Boundary markers: There are no explicit instructions provided to the agent to delimit or ignore potentially malicious embedded content within the bid descriptions.
- Capability inventory: The skill has the capability to read from the filesystem and write analysis results to Excel files, which is consistent with its stated purpose.
- Sanitization: While the skill validates numerical inputs for variance calculations, it does not apply specific sanitization to textual fields like item descriptions.
Audit Metadata