zoho-people
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill references sensitive credentials such as
APIDECK_API_KEYandAPIDECK_APP_ID. It correctly demonstrates accessing these via environment variables (process.env), which is a standard and safe practice for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from Zoho People (employees, departments, time-off records). This creates a surface for indirect prompt injection if the source data contains malicious instructions.
- Ingestion points: External HRIS data retrieved from Zoho People via Apideck's API.
- Boundary markers: None identified in the provided instructions.
- Capability inventory: Capability to read and sync HRIS data using the
@apideck/unifySDK as shown inSKILL.md. - Sanitization: No explicit sanitization or validation of the retrieved external content is described in the skill.
Audit Metadata