bamboohr-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external codebases and configurations using tools like
Read,Glob, andGrep. This introduces a potential surface for indirect prompt injection if the target repository contains malicious content intended to influence the agent's behavior. - Ingestion points: Target repository code and configuration files via
Read,Glob, andGrep(SKILL.md). - Boundary markers: None specified for file reading operations.
- Capability inventory: The skill allows
WriteandEditoperations on the filesystem. - Sanitization: The instructions explicitly require redacting authorization headers, keys, and PII, and demand security/data-owner approval before performing sensitive operations.
- [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of official BambooHR SDKs and documentation hosted on GitHub and official domains.
- References: Points to the official BambooHR GitHub organization (
github.com/BambooHR) for Python and PHP SDKs and their developer documentation (documentation.bamboohr.com).
Audit Metadata