procore-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Procore API, which could potentially contain malicious instructions meant to influence the agent's behavior.
- Ingestion points: The Python script in
SKILL.mdfetches data fromhttps://api.procore.com/rest/v1.0/companies. - Boundary markers: The implementation does not include specific delimiters or instructions to the agent to disregard instructions potentially embedded within the API response.
- Capability inventory: The skill allows access to
Read,Write,Edit, andBash(npm, pip, curl) tools, creating a capability surface for downstream actions based on processed data. - Sanitization: The provided example script performs no validation or sanitization of the JSON response from the API before printing or processing.
Audit Metadata