bamboohr-install-auth
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong credential management policies. It explicitly instructs the agent to store authentication tokens and API keys in secure deployment secret managers and forbids their inclusion in logs, environment variables examples, or client-side code.
- [SAFE]: The skill references official BambooHR documentation and GitHub repositories. These are well-known service resources. Furthermore, the skill provides proactive security advice by warning the agent that certain SDK distributions are not yet on public registries, necessitating manual verification of commit pins.
- [INDIRECT_PROMPT_INJECTION]: The skill contains logic to mitigate potential prompt injection through untrusted data.
- Ingestion points: The
argument-hintdefines atenant-subdomainparameter which is interpolated into API URLs. - Boundary markers: The instructions include a specific constraint: "do not accept a full arbitrary host from untrusted input," forcing the agent to derive the subdomain from a trusted URL format.
- Capability inventory: The skill uses file-system tools (
Read,Glob,Grep,Write,Edit) to update configuration files. - Sanitization: The skill mandates the use of placeholders during configuration and requires explicit validation of the tenant subdomain structure.
Audit Metadata