skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-material-procurement/Gen Agent Trust Hub
cwicr-material-procurement
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references vendor-owned resources on datadrivenconstruction.io and GitHub for additional documentation and source code access.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external construction project data which serves as a surface for potential indirect prompt injection.
- Ingestion points: Data is accepted via work item lists and CWICR dataframes in the CWICRMaterialProcurement class methods.
- Boundary markers: No explicit delimiters are used to wrap user-supplied string data during processing.
- Capability inventory: The skill utilizes filesystem permissions to write Excel reports via the export_to_excel method.
- Sanitization: The implementation focuses on numeric calculations and does not explicitly sanitize string-based inputs like material descriptions.
Audit Metadata