skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/excel-to-rvt/Gen Agent Trust Hub
excel-to-rvt
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runto execute a local command-line toolImportExcelToRevit.exe. This functionality allows the agent to trigger local execution of external binaries. - [DYNAMIC_EXECUTION]: The
DynamoScriptGeneratorclass inSKILL.mdgenerates Python scripts by directly interpolating variables likeexcel_pathandschedule_nameinto string templates. This implementation is vulnerable to code injection if these inputs contain malicious Python syntax. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Excel files to update Revit models and generate Dynamo scripts. It lacks mechanisms to sanitize this data or distinguish it from instructions, creating a surface where malicious content in a spreadsheet could influence agent behavior or the generated output.
- Ingestion points: Revit element data and Excel file paths processed in
SKILL.md. - Boundary markers: None present in the data processing logic.
- Capability inventory: File system access, script generation, and command execution via
subprocess.run. - Sanitization: No sanitization is performed on data values before interpolation into generated scripts.
- [EXTERNAL_DOWNLOADS]: The skill provides references to a GitHub repository hosted by
datadrivenconstructionfor Revit data pipeline resources.
Audit Metadata