skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-resource-analyzer/Gen Agent Trust Hub
cwicr-resource-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes construction project data from external files (Excel, CSV, JSON) to calculate resource requirements. This creates an attack surface for indirect prompt injection where instructions could be embedded in the data fields. However, the processing logic is strictly computational and numeric, using pandas and numpy, which significantly mitigates the risk of the agent executing embedded instructions.
- Ingestion points:
itemslist passed to analysis methods,cwicr_dataDataFrame inCWICRResourceAnalyzerconstructor. - Boundary markers: Not explicitly defined in the provided code.
- Capability inventory:
filesystemaccess is requested inclaw.jsonfor data processing. No network operations or file-write capabilities are implemented in the provided scripts. - Sanitization: Input data is converted to floats and strings for calculation purposes, which serves as implicit sanitization for the core logic.
- [EXTERNAL_DOWNLOADS]: The skill references the vendor's official GitHub repository (
github.com/datadrivenconstruction/OpenConstructionEstimate-DDC-CWICR) for documentation. This is a legitimate reference to the author's own public resources and does not involve remote code execution.
Audit Metadata