skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/bim-cost-estimation-cwicr/Gen Agent Trust Hub
bim-cost-estimation-cwicr
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script uses
subprocess.runto call a local executable atC:\DDC\RvtExporter.exe. This is a vendor-provided tool from 'datadrivenconstruction' used for its primary purpose of BIM data extraction and conversion to Excel format. - [EXTERNAL_DOWNLOADS]: The skill interacts with the OpenAI API for generating embeddings and performing work item decomposition. It also connects to a user-configured Qdrant vector database. These are well-known services used appropriately for the skill's core functionality.
- [PROMPT_INJECTION]: The skill processes external element descriptions from BIM models through an LLM to decompose them into work items.
- Ingestion points: Element names and categories from BIM models are read from Excel files via
pandasin theestimate_from_qtomethod. - Boundary markers: The prompt relies on structural formatting instructions for JSON output rather than explicit delimiters, though it provides clear examples to the LLM.
- Capability inventory: The skill can execute the local BIM exporter command, write Excel reports to the filesystem, and perform network requests to AI and database endpoints.
- Sanitization: LLM responses are handled via
json.loadswithin a try-except block, and the output is used for database queries rather than being passed to a shell or execution engine. - [SAFE]: API credentials for OpenAI and Qdrant are correctly managed through environment variables (
OPENAI_API_KEY,QDRANT_URL), and no hardcoded secrets were detected.
Audit Metadata