skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/progress-photo-analyzer/Gen Agent Trust Hub
progress-photo-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as CSV, Excel, and JSON files as specified in the
instructions.mdfile. The implementation lacks explicit sanitization, validation, or boundary markers to differentiate between data and potential instructions. - Ingestion points: Processes external project data, file paths, and structured data files (CSV, Excel, JSON) provided by the user as described in
instructions.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are implemented in the
SKILL.mdlogic orinstructions.mdto protect the agent from potential malicious content embedded in user data. - Capability inventory: The skill possesses filesystem write capabilities via the
export_reportmethod inSKILL.md, allowing it to save processed data to the local disk. - Sanitization: There is no evidence of input sanitization or content validation within the provided Python code to filter out potential injection patterns from processed data.
Audit Metadata