skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-escalation/Gen Agent Trust Hub
cwicr-escalation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied data in formats such as CSV, Excel, and Parquet, which constitutes a potential attack surface for instructions embedded in data.
- Ingestion points: User-provided data files processed via
pandas.read_parquetand other data loading methods described inSKILL.mdandinstructions.md. - Boundary markers: None identified in the provided instructions or code templates.
- Capability inventory: The skill has filesystem write access through the
export_escalationmethod which usespd.ExcelWriterto output files. - Sanitization: No explicit sanitization or validation of data content for embedded natural language instructions is present.
- [COMMAND_EXECUTION]: The skill includes Python implementation code for cost calculations. The code utilizes standard libraries like
pandas,numpy, andopenpyxlto perform mathematical operations and handle data structures. - [EXTERNAL_DOWNLOADS]: The skill's documentation references the vendor's official GitHub repository (
github.com/datadrivenconstruction/OpenConstructionEstimate-DDC-CWICR) as a resource for the open-source project. This reference represents a standard pointer to project resources.
Audit Metadata