procore-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides boilerplate Python code for OAuth2 authentication and basic API interaction with Procore. It correctly avoids hardcoding secrets, instead instructing the use of environment variables (
PROCORE_CLIENT_IDandPROCORE_CLIENT_SECRET). All network requests are directed to official Procore domains (login.procore.comandapi.procore.com). - [INDIRECT_PROMPT_INJECTION]: The skill establishes a pattern for ingesting data from an external REST API, which is an inherent injection surface for untrusted content. However, the risk is negligible in this context as the provided example only processes the response to count items.
- Ingestion points: REST API response from
api.procore.cominSKILL.md. - Boundary markers: None present in the code snippet.
- Capability inventory: The skill environment allows file manipulation and shell command execution, but the template code does not perform dangerous operations with the ingested data.
- Sanitization: None present in the simplified example.
Audit Metadata