afas
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues or malicious patterns were identified in the instructions or provided examples. The skill provides architectural guidance for using Apideck's HRIS API.
- [INDIRECT_PROMPT_INJECTION]: The skill describes methods for reading and syncing HRIS data such as employee records, payroll, and time-off requests. This introduces a potential surface for indirect prompt injection if the ingested data from the external service contains malicious instructions. As this is a documentation-focused skill, it does not implement risky data processing, but the surface is present.
- Ingestion points: External HRIS data (employees, departments, payroll) fetched via Apideck APIs.
- Boundary markers: Not applicable to documentation skills.
- Capability inventory: The skill describes network operations via the
@apideck/unifySDK andcurlcommands to the Apideck Unify API. - Sanitization: Not specified; developers are expected to follow standard sanitization practices when processing external API data.
- [EXTERNAL_DOWNLOADS]: The skill references official OpenAPI specifications (specs.apideck.com) and documentation sites (developers.apideck.com). These are legitimate vendor resources used for configuration and developer guidance.
Audit Metadata