The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests external HR data while possessing write capabilities.
Ingestion points: The skill fetches untrusted data from BambooHR using tools like BAMBOOHR_GET_ALL_EMPLOYEES, BAMBOOHR_GET_EMPLOYEE, BAMBOOHR_GET_TIME_OFF_REQUESTS, and BAMBOOHR_DEPENDENTS_GET_ALL (in SKILL.md).
Boundary markers: There are no clear delimiters or instructions provided in SKILL.md to ensure the agent ignores potentially malicious commands embedded in the retrieved employee records or notes.
Capability inventory: The agent has the ability to modify data through tools like BAMBOOHR_CREATE_TIME_OFF_REQUEST, BAMBOOHR_UPDATE_TIME_OFF_REQUEST, and BAMBOOHR_UPDATE_EMPLOYEE (in SKILL.md).
Sanitization: No sanitization, filtering, or validation steps are defined to clean external data before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill requires connection to an external MCP server at https://rube.app/mcp provided by Composio. This is a well-known service for AI agent toolkits.

bamboohr-automation