afas

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues or malicious patterns were identified in the instructions or provided examples. The skill provides architectural guidance for using Apideck's HRIS API.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes methods for reading and syncing HRIS data such as employee records, payroll, and time-off requests. This introduces a potential surface for indirect prompt injection if the ingested data from the external service contains malicious instructions. As this is a documentation-focused skill, it does not implement risky data processing, but the surface is present.
  • Ingestion points: External HRIS data (employees, departments, payroll) fetched via Apideck APIs.
  • Boundary markers: Not applicable to documentation skills.
  • Capability inventory: The skill describes network operations via the @apideck/unify SDK and curl commands to the Apideck Unify API.
  • Sanitization: Not specified; developers are expected to follow standard sanitization practices when processing external API data.
  • [EXTERNAL_DOWNLOADS]: The skill references official OpenAPI specifications (specs.apideck.com) and documentation sites (developers.apideck.com). These are legitimate vendor resources used for configuration and developer guidance.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 06:32 PM