xlsx-construction

Pass

Audited by Gen Agent Trust Hub on Mar 5, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill requests filesystem access to perform its primary function of reading and writing spreadsheet files (Excel, CSV). This access is necessary for the stated purpose of managing construction documents.
  • [PROMPT_INJECTION]: The skill processes external data (Excel, CSV, BIM exports) which serves as an ingestion point for potentially untrusted content. This is a common pattern for document processing skills.
  • Ingestion points: The process_qto_from_bim function in SKILL.md reads external Excel files using pandas.read_excel.
  • Boundary markers: No specific delimiters or "ignore instructions" markers are used in the data processing code.
  • Capability inventory: Filesystem read/write capabilities are present via the openpyxl and pandas libraries.
  • Sanitization: No explicit sanitization or content validation of the spreadsheet data is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 5, 2026, 04:28 AM