skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/unit-price-database-manager/Gen Agent Trust Hub
unit-price-database-manager
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes construction unit price data from external CSV files which serves as a potential vector for indirect prompt injection. Ingestion points: Data is ingested via the UnitPriceDatabaseManager.import_from_csv method in SKILL.md, which reads user-specified CSV files. Boundary markers: The skill does not implement delimiters or instructions to ignore embedded instructions within the imported data. Capability inventory: The skill possesses filesystem write permissions via export_to_csv and the ability to process and display item descriptions to the agent. Sanitization: There is no evidence of data sanitization, validation, or escaping of the content imported from external files before it is processed by the agent.
Audit Metadata