skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/rvt-to-ifc/Gen Agent Trust Hub
rvt-to-ifc
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes an external binary
RVT2IFCconverter.exeviasubprocess.runto perform file conversions. This is the primary function of the skill and is explicitly described in the documentation. - [INDIRECT_PROMPT_INJECTION]: The
validate_outputfunction inSKILL.mdreads up to 1000 characters from generated or provided IFC files to check for valid headers and version strings. This processing of untrusted file data into the agent's context creates a potential surface for indirect prompt injection. - Ingestion points: Reading content from
.ifcfiles inSKILL.mdviaf.read(1000). - Boundary markers: No delimiters or safety instructions are used when reading the file content.
- Capability inventory: The skill uses
subprocess.runfor command execution and hasfilesystempermissions for reading and writing files. - Sanitization: The skill only performs basic substring checks for version identification and does not sanitize or escape the content read from the file.
Audit Metadata