bamboohr-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and configuration files which could contain malicious instructions.
- Ingestion points: The skill uses Read, Glob, and Grep to inspect the target repository's code, configuration, and metrics (SKILL.md).
- Boundary markers: There are no instructions to use delimiters or ignore instructions embedded within the files being optimized.
- Capability inventory: The skill is authorized to use Write and Edit tools to modify code, such as changing refresh frequencies, caching logic, and log retention (SKILL.md).
- Sanitization: No sanitization process is defined for the content read from the repository.
- [EXTERNAL_DOWNLOADS]: The skill refers to official BambooHR SDKs and documentation.
- References official BambooHR GitHub repositories and developer documentation for guidance (github.com/BambooHR/bhr-api-python, github.com/BambooHR/bhr-api-php, documentation.bamboohr.com).
- Mentions the official bamboohr/api package from the Packagist registry.
- Notes a discrepancy regarding the bamboohr-sdk package availability on PyPI and recommends verification (references/official-docs.md).
Audit Metadata