skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-schedule-integrator/Gen Agent Trust Hub
cwicr-schedule-integrator
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a comprehensive Python implementation for construction data processing, including cost distribution algorithms (Uniform, S-curve, etc.) and earned value metric calculations.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external CSV and Excel files. While the current logic is focused on data manipulation, untrusted input files could theoretically contain instructions intended to influence the agent's behavior.
- Ingestion points: The function
import_schedule_from_csvinSKILL.mdreads project data directly from CSV files. - Boundary markers: The
instructions.mdfile explicitly instructs the agent to validate inputs before processing, serving as a procedural safeguard. - Capability inventory: The skill utilizes filesystem permissions to read CSV files and write Excel reports using the pandas library.
- Sanitization: The agent is constrained by the instructions to only use provided data and validate inputs, although the Python code itself does not implement programmatic sanitization for path traversal within the provided snippets.
Audit Metadata