skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/material-procurement-tracker/Gen Agent Trust Hub
material-procurement-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process project data from external files such as CSV, Excel, and JSON, creating a surface for indirect prompt injection attacks.
- Ingestion points: The instructions.md file directs the agent to accept and analyze project data provided in various common file formats.
- Boundary markers: Instructions in instructions.md recommend that the agent validate inputs and only use provided data, providing a natural language boundary that lacks technical enforcement.
- Capability inventory: The Python implementation in SKILL.md utilizes the pandas library for data manipulation and includes functionality to write files to the filesystem via the export_log method.
- Sanitization: The skill does not implement technical sanitization or filtering logic within its code to identify or neutralize malicious prompt instructions embedded in the data it processes.
Audit Metadata