skills/jeremylongshore/tons-of-skills-marketplace/bamboohr-reference-architecture/Gen Agent Trust Hub
bamboohr-reference-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a reference architecture document intended to guide developers in building secure integrations. It does not contain executable code, hidden commands, or malicious instructions.
- [EXTERNAL_DOWNLOADS]: The skill references official Python and PHP SDKs and documentation hosted on GitHub and Packagist for the BambooHR organization. These references point to well-known, legitimate service repositories and are used strictly for informational grounding.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines architecture for handling external data (webhooks and API responses). It explicitly addresses security risks by instructing the implementation of strict boundary controls.
- Ingestion points: Webhook ingress and API response data plane (SKILL.md).
- Boundary markers: The skill mandates explicit trust boundaries for consent, token storage, and webhook reception.
- Capability inventory: The design identifies tool requirements for reading, writing, and processing HR data but restricts the skill's own tools (Read, Glob, Grep) to documentation and grounding tasks.
- Sanitization: The instructions require verified HMAC signatures for webhooks, schema version enforcement, and field allowlists before data enters storage or downstream queues.
Audit Metadata