skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-comparison-tool/Gen Agent Trust Hub
cwicr-comparison-tool
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implementation follows best practices for data processing, utilizing reputable libraries such as
pandasandnumpy. The logic is transparently implemented within the skill documentation and aligns perfectly with the stated business purpose of estimate comparison.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from CSV, Excel, and JSON files provided by the user, which creates a potential surface for indirect prompt injection where instructions could be embedded in data fields.\n - Ingestion points: Project data files and parameters accepted via CSV, Excel, and JSON formats as specified in
instructions.md.\n - Boundary markers: The skill does not explicitly define boundary markers or 'ignore' instructions for the agent when processing user-provided content.\n
- Capability inventory: The skill has filesystem write permissions to export analysis results to Excel files and uses Python for data manipulation.\n
- Sanitization: While the skill performs rigorous numeric calculations and data merging which inherently mitigates many injection risks, it does not explicitly sanitize natural language content within the data fields.
Audit Metadata