skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/punch-list-manager/Gen Agent Trust Hub
punch-list-manager
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project data in formats like CSV, Excel, and JSON. This constitutes an attack surface where malicious data could potentially influence the agent, although the impact is limited by the skill's specific focus on construction documentation.
- Ingestion points: Data input via common formats (CSV, Excel, JSON) mentioned in
instructions.md. - Boundary markers: None explicitly defined to separate untrusted data from the prompt context.
- Capability inventory: Filesystem write capability via the
export_to_excelmethod inSKILL.md. - Sanitization: Instructions explicitly constrain the assistant to "Validate inputs before processing".
- [SAFE]: The Python implementation in
SKILL.mdfollows standard development practices using thepandaslibrary for data export. No evidence of obfuscation, hardcoded credentials, or unauthorized network activity was found. The skill's metadata and functionality align with its stated purpose, and external links point to the vendor's verified infrastructure.
Audit Metadata