skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/dgn-to-excel/Gen Agent Trust Hub
dgn-to-excel
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
DgnExporter.exeutility using Python'ssubprocess.runfunction. The implementation securely passes arguments as a list, avoiding the use ofshell=True, which prevents shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted DGN files to extract metadata, text, and geometry.
- Ingestion points: DGN files are loaded via the
convertandbatch_convertmethods defined inSKILL.md. - Boundary markers: None; the skill relies on the external
DgnExporterbinary to parse the complex CAD format. - Capability inventory: The skill possesses filesystem read/write permissions and the ability to execute subprocesses.
- Sanitization: The conversion logic extracts structured data into Excel, which provides some isolation, but the raw text content from the DGN elements is not explicitly sanitized before being presented to the agent.
- [EXTERNAL_DOWNLOADS]: The skill requires a local installation of
DgnExporter.exe. This tool is provided by the skill's author,datadrivenconstruction, and is documented as a necessary component for the CAD conversion pipeline.
Audit Metadata