skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-labor-scheduler/Gen Agent Trust Hub
cwicr-labor-scheduler
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate labor scheduling calculations using the CWICR database standards. No malicious patterns such as hardcoded credentials, network exfiltration, or obfuscated code were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided project data (CSV, Excel, JSON) which represents a potential attack surface.
- Ingestion points: Data provided by the user via file paths or direct input as specified in
instructions.mdandSKILL.md. - Boundary markers: Not explicitly defined in the code, but the logic is focused on numeric calculations and scheduling data.
- Capability inventory: Filesystem read/write capabilities are used for data ingestion and exporting reports via
pandasandopenpyxl. - Sanitization: The
instructions.mdfile contains a specific directive to "Validate inputs before processing," which serves as a security best practice for handling external data.
Audit Metadata