skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-material-substitution/Gen Agent Trust Hub
cwicr-material-substitution
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project data and file paths provided by the user, which presents a surface for indirect prompt injection.\n
- Ingestion points: The skill accepts project data in CSV, Excel, and JSON formats as described in
instructions.md.\n - Boundary markers: The
instructions.mdfile includes constraints to only use provided data and validate inputs.\n - Capability inventory: The Python implementation includes filesystem write capabilities via
pandas.ExcelWriterin theexport_substitution_reportmethod.\n - Sanitization: No explicit data sanitization logic is implemented in the Python scripts.\n- [EXTERNAL_DOWNLOADS]: The skill references the author's GitHub repository for further resources.\n- [COMMAND_EXECUTION]: The skill requires
python3for executing the data analysis logic defined inSKILL.md.
Audit Metadata