bamboohr-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official SDKs and documentation from BambooHR's GitHub repositories (
BambooHR/bhr-api-python,BambooHR/bhr-api-php) and official package registries like Packagist. These are well-known and trusted sources for this specific HR service integration. - [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests and processes repository data to determine integration patterns.
- Ingestion points: The skill uses
Read,Glob, andGrepto inventory the local repository's language, package lock files, and existing HTTP clients. - Boundary markers: The instructions state that customer-specific permissions and agreements remain authoritative, and require approval before adding dependencies or making live calls.
- Capability inventory: The skill uses
WriteandEdittools to implement the approved adapter and corresponding tests. - Sanitization: The skill explicitly instructs the agent to implement secret redaction, normalize errors into redacted summaries, and maintain tenant isolation to prevent data leakage.
Audit Metadata