skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/pptx-construction/Gen Agent Trust Hub
pptx-construction
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process construction project data from external files (Excel, CSV, JSON) to generate automated reports. This ingestion process presents an attack surface where malicious instructions hidden in data fields (e.g., project descriptions or milestone statuses) could attempt to influence the agent's logic.
- Ingestion points: Reads data from Excel files (schedule_data.xlsx, budget_data.xlsx) and user-provided JSON structures used in presentation methods.
- Boundary markers: The assistant instructions include a constraint to "Validate inputs before processing," which serves as a basic check but may not prevent sophisticated injection.
- Capability inventory: The skill uses the python-pptx library to create and save .pptx files and uses pandas for data manipulation.
- Sanitization: No explicit sanitization or escaping of the input data strings before they are inserted into the presentation templates is shown in the provided code snippets.
- [EXTERNAL_DOWNLOADS]: The skill relies on external libraries including python-pptx and pandas, which are standard packages in the Python ecosystem.
Audit Metadata