paychex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to read employee, payroll, and time-off records from Paychex via Apideck, which returns third-party data containing outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill integrates with Paychex via Apideck's HRIS API to read, sync, and manage HRIS records such as employees, departments, payrolls, and time-off records. Payroll and HRIS integration functions as indirect financial exposure (submitting payroll/paychecks or personnel records for downstream handling), which falls under indirect operations. Independent access control is established via authenticated Apideck API keys and OAuth 2.0 managed through Apideck Vault.