bamboohr-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official BambooHR SDK repositories and documentation hosted on GitHub and Packagist. These references target the official developer resources for the BambooHR service.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process log files which may contain untrusted data generated by external interactions.
- Ingestion points: System and application logs located via
GlobandGrepas described inSKILL.md. - Boundary markers: The instructions explicitly require scanning the output for secrets and PII, followed by a manual review process.
- Capability inventory: The skill is restricted to file operations (
Read,Glob,Grep,Write,Edit). It does not have access to network tools or arbitrary shell execution. - Sanitization: The skill provides a detailed protocol for redacting identifiers, removing sensitive headers, and using stable aliases to replace employee data.
Audit Metadata