skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/cwicr-work-breakdown/Gen Agent Trust Hub
cwicr-work-breakdown
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external project data in formats such as CSV, Excel, and JSON, which presents a potential surface for indirect prompt injection.
- Ingestion points: The skill accepts data via user-provided file paths or direct input as described in instructions.md.
- Boundary markers: The agent is instructed to "Validate inputs before processing," providing a basic layer of input checking.
- Capability inventory: The skill utilizes the
pandasandopenpyxllibraries to perform data transformations and write results to the local filesystem. - Sanitization: Standard pandas data loading is used; specific data sanitization logic is not explicitly defined in the provided Python code.
- [COMMAND_EXECUTION]: The skill configuration requires the execution of the
python3binary to run the provided resource breakdown logic. - Evidence: The requirement is specified in the
metadatafield of the SKILL.md frontmatter and thebinsrequirement in claw.json.
Audit Metadata