skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/labor-allocation/Gen Agent Trust Hub
labor-allocation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process project data from external sources such as CSV, Excel, and JSON files as described in
instructions.md. This represents an untrusted data ingestion surface where malicious instructions could be embedded to influence the agent's output or actions. - Ingestion points: The
instructions.mdfile specifies that the agent should accept data in common formats (CSV, Excel, JSON). - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the processed data.
- Capability inventory: The skill possesses file system write access via the
export_to_excelmethod inSKILL.md. - Sanitization: While
instructions.mdmentions validating inputs, the implementation inSKILL.mddoes not demonstrate specific sanitization or filtering of the content within the data structures. - [COMMAND_EXECUTION]: The
export_to_excelmethod inSKILL.mdtakes anoutput_pathparameter to save labor data. If this path is not strictly validated or sandboxed by the agent, it could be used to write files to sensitive or unintended locations on the host system.
Audit Metadata