skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/duration-prediction/Gen Agent Trust Hub
duration-prediction
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The technical implementation consists of standard Python code using NumPy and Pandas to perform project duration forecasting via k-Nearest Neighbors and Linear Regression models.
- [SAFE]: The skill requests filesystem permissions in its configuration (claw.json). This is consistent with its primary function of analyzing project datasets stored locally (CSV, Excel, JSON). No network exfiltration or credential harvesting patterns were observed.
- [INDIRECT_PROMPT_INJECTION]: A vulnerability surface exists where untrusted project data is ingested from external files (CSV, Excel, JSON) or direct input. Evidence Chain: 1. Ingestion points: instructions.md and DurationPredictor.load_training_data in SKILL.md. 2. Boundary markers: Instructions explicitly mandate input validation before processing. 3. Capability inventory: Filesystem read access and Python-based calculation. 4. Sanitization: The implementation uses strict type-casting (int, float, bool) and Enum-based validation for all processed project features, effectively mitigating the risk of instructions embedded in data fields.
Audit Metadata