skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/excel-to-bim/Gen Agent Trust Hub
excel-to-bim
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
RevitExcelUpdaterclass inSKILL.mdutilizessubprocess.runto call an external executable namedImportExcelToRevit.exe. This tool is used to perform batch updates on Revit models from enriched Excel data.\n- [DYNAMIC_EXECUTION]: Thegenerate_dynamo_scriptmethod inExcelToBIMUpdaterdynamically constructs a Python script file for Revit. It does this by interpolating element update data, extracted from user-supplied Excel spreadsheets, into a predefined script template.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Excel files to drive BIM model updates, representing a potential injection surface.\n - Ingestion points: Data is loaded from user-provided files via
pd.read_excelin theExcelToBIMUpdaterandDataEnrichmentWorkflowclasses.\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between valid data and potentially malicious instructions embedded in the Excel rows.\n
- Capability inventory: The skill possesses the capability to write scripts to the filesystem and execute external CLI tools via the subprocess module.\n
- Sanitization: The implementation uses
json.dumpsto escape and serialize data before embedding it into the generated Dynamo script, providing a baseline layer of protection against simple code injection.
Audit Metadata