bamboohr-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional code snippets for BambooHR API integration. It correctly utilizes environment variables (
BAMBOOHR_API_KEY,BAMBOOHR_COMPANY_DOMAIN) for secret management rather than hardcoding sensitive credentials. - [INDIRECT_PROMPT_INJECTION]: The skill features a vulnerability surface where it ingests and processes data from an external API, which is a standard risk for integration skills.
- Ingestion points: Data is fetched from BambooHR API endpoints including employee directory, individual employee profiles, and custom reports in the TypeScript and Python examples.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the provided code snippets.
- Capability inventory: The skill's execution environment allows for
Read,Write,Edit, andBashtool usage. - Sanitization: The example snippets do not implement sanitization or validation of the retrieved API data before printing it to the console output.
Audit Metadata