skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-subcontractor/Gen Agent Trust Hub
cwicr-subcontractor
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data provided by users in formats such as CSV, Excel, and JSON.\n
- Ingestion points: User-provided project data and files via instructions.md.\n
- Boundary markers: Not explicitly defined in the agent instructions.\n
- Capability inventory: File system read and write operations via pandas in SKILL.md.\n
- Sanitization: The implementation lacks robust sanitization for external data input.\n- [COMMAND_EXECUTION]: The skill utilizes the Python interpreter and file system permissions to perform data processing and report generation. This behavior is expected given the skill's utility for construction cost analysis.
Audit Metadata