procore-rate-limits
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices by instructing the user to store sensitive credentials like
PROCORE_CLIENT_IDandPROCORE_CLIENT_SECRETin environment variables rather than hardcoding them. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Procore API responses, which is a common surface for indirect prompt injection.
- Ingestion points: Data retrieved from
https://api.procore.com/rest/v1.0/companiesinSKILL.md. - Boundary markers: Absent; the code processes the JSON response directly.
- Capability inventory: The skill is configured with access to
Write,Edit, andBashtools. - Sanitization: Absent; the sample code prints the length of the data without validation or sanitization, though this is typical for a basic integration example.
Audit Metadata