recruitee
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill recommends using environment variables (APIDECK_API_KEY, APIDECK_APP_ID) to handle authentication credentials, which is a secure practice for managing sensitive information.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references and fetches resources from official Apideck domains, including documentation and API specifications (e.g., specs.apideck.com, developers.apideck.com). These are recognized as trusted vendor sources.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates data exchange with the Recruitee ATS, creating a potential surface for indirect prompt injection via external data. -- Ingestion points: API responses containing job and applicant data from Recruitee (SKILL.md). -- Boundary markers: No specific delimiters or warnings for embedded content are included in the code snippets. -- Capability inventory: The skill uses the @apideck/unify SDK for API interactions and makes network calls to the Apideck gateway (SKILL.md). -- Sanitization: Data handling is performed through the official vendor SDK.
Audit Metadata