bamboohr-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official BambooHR SDKs and API specifications from their verified GitHub organization and official developer documentation portal. It includes appropriate warnings to verify the distribution availability and integrity of these packages before installation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle external webhook events, which introduces a potential surface for indirect prompt injection if malicious payloads are processed.
- Ingestion points: Webhook receiver endpoints for employee and field-based event delivery.
- Boundary markers: Instructions mandate the implementation of HTTPS, HMAC-SHA256 signature verification, and event allowlists to validate incoming requests.
- Capability inventory: The skill utilizes file system tools (Read, Glob, Grep, Write, Edit) for handler implementation and configuration inspection.
- Sanitization: Guidelines require constant-time signature comparison and early rejection of terminal or unauthorized payloads before the agent processes any data.
Audit Metadata