skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-quantity-matcher/Gen Agent Trust Hub
cwicr-quantity-matcher
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes BIM element descriptions and quantities from user-supplied files, creating a potential surface for indirect prompt injection where instructions in the data could influence the assistant's behavior during analysis.
- Ingestion points:
match_quantitiesmethod inSKILL.md(processing thebim_dataDataFrame). - Boundary markers: The skill does not implement delimiters or specific instructions to ignore content within the data fields.
- Capability inventory: The skill has declared
filesystempermissions and includes methods for writing results to Excel files. - Sanitization: No sanitization is performed on descriptive text fields before they are used in similarity matching or potential assistant summaries.
- [SAFE]: The skill references an official GitHub repository (
github.com/datadrivenconstruction/OpenConstructionEstimate-DDC-CWICR) which belongs to the verified author. - [SAFE]: The implementation relies on well-known and standard Python data science libraries, including
pandasandnumpy.
Audit Metadata