procore-deploy-integration
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices by recommending the use of environment variables (PROCORE_CLIENT_ID, PROCORE_CLIENT_SECRET) instead of hardcoded credentials to access the construction management platform.\n- [SAFE]: All network requests are targeted at official Procore domains (login.procore.com, api.procore.com) for OAuth2 authentication and resource access, which are recognized as well-known service endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external API endpoints, representing a standard vulnerability surface for data-processing integrations.\n
- Ingestion points: Fetches construction project and company data from api.procore.com (documented in SKILL.md).\n
- Boundary markers: Absent; the instructions do not specify delimiters for API data processed by the agent.\n
- Capability inventory: The agent environment supports Read, Write, Edit, and Bash operations through the allowed-tools configuration.\n
- Sanitization: The example code does not include explicit validation or escaping for the retrieved JSON data.
Audit Metadata