procore-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data provided by the Procore API, which represents a surface for indirect prompt injection if the project data contains malicious instructions.\n
- Ingestion points: Data retrieved from
requests.getinSKILL.mdis processed and printed.\n - Boundary markers: None present in the code snippets to delimit API-sourced text.\n
- Capability inventory: The skill is configured with
Read,Write,Edit, andBashtools in the frontmatter.\n - Sanitization: No explicit sanitization or filtering of the API-returned content is performed in the provided workflow snippets.\n- [SAFE]: All API calls target the official Procore developer platform, a well-known construction technology service. The code uses the standard Python
requestslibrary to perform routine project management tasks.
Audit Metadata