skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/submittal-tracker/Gen Agent Trust Hub
submittal-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes construction project data from external file formats like CSV and Excel, which serves as a potential vector for indirect prompt injection attacks where malicious instructions could be embedded in the data.
- Ingestion points: The agent accepts data through user-provided files and parameters as documented in
instructions.md. - Boundary markers: There are no specific delimiters used to isolate processed data from the agent's core instructions.
- Capability inventory: The skill utilizes the
filesystempermission to write logs to disk via thepandas.to_excelmethod inSKILL.md. - Sanitization: The instructions include a high-level directive to validate inputs, but specific implementation details for filtering or escaping data are not provided.
- [COMMAND_EXECUTION]: The skill performs file system operations as part of its core tracking functionality.
- The
export_logmethod inSKILL.mdperforms a file system write operation to a user-provided path using thepandaslibrary.
Audit Metadata