workhuman-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides comprehensive instructions for secure adapter design, including the redaction of authorization and workforce data from errors and the prevention of cross-tenant reuse.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external API schemas and integration specifications, which is a potential surface for indirect prompt injection. The instructions mandate validation of response envelopes and rejection of unsafe type coercion to mitigate risks associated with processing untrusted data.
- [EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to retrieve first-party context from Workhuman's official integration documentation. This is a legitimate use of the tool for a well-known service.
Audit Metadata