skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/material-delivery-tracker/Gen Agent Trust Hub
material-delivery-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external project data which presents a surface for indirect prompt injection attacks.
- Ingestion points: The
instructions.mdfile specifies that the agent should accept data in common formats such as CSV, Excel, and JSON from users. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the processed data files.
- Capability inventory: The skill has the capability to write files to the local filesystem using the
export_schedulemethod inSKILL.md(via pandas and openpyxl). - Sanitization: The provided Python implementation does not include explicit validation or sanitization of the content within the imported data files to prevent malicious instructions from influencing the agent's behavior.
Audit Metadata