skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-productivity-tracker/Gen Agent Trust Hub
cwicr-productivity-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and metadata reference external resources hosted at datadrivenconstruction.io and github.com/datadrivenconstruction. These are legitimate resources belonging to the skill author for documentation and database access.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied data in CSV, Excel, and JSON formats. While processing external data is a potential attack surface for indirect prompt injection, the implementation uses structured data processing and numeric calculations which significantly limit the risk of code execution or instruction hijacking.
- Ingestion points: The
track_daily_productionandcalculate_productivitymethods inSKILL.mdingest user-provided work records. - Boundary markers: None explicitly implemented in the logic, though instructions tell the agent to validate inputs.
- Capability inventory: The skill performs file reading via
pandas.read_parquetand file writing viapandas.ExcelWriterinSKILL.md. - Sanitization: Relies on standard pandas data parsing; no specific sanitization for embedded instructions is present.
- [COMMAND_EXECUTION]: The skill utilizes Python with the pandas and numpy libraries to perform data manipulation and productivity forecasting. All operations are confined to standard data processing tasks as defined in the technical implementation.
Audit Metadata