skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/drone-site-survey/Gen Agent Trust Hub
drone-site-survey
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external files provided by the user, creating a vulnerability to embedded instructions.
- Ingestion points: The skill accepts project data, file paths, and parameters in common formats including CSV, Excel, and JSON as specified in
instructions.md. - Boundary markers: There are no explicit delimiters or specific system instructions provided to the agent to ignore potentially malicious commands embedded within these data files.
- Capability inventory: The skill possesses filesystem write permissions, using libraries like
pandasandopenpyxlto save survey reports and data summaries to the disk. - Sanitization: Although
instructions.mdcontains a high-level constraint to "Validate inputs before processing," the actual implementation inSKILL.mdlacks explicit sanitization or content validation logic for the ingested data.
Audit Metadata