implement-scim
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a webhook endpoint that ingests untrusted data from external directory providers.
- Ingestion points: Data enters via the
POST /webhooks/scalekitroute. - Boundary markers: The skill includes a mandatory guardrail requiring
verifyWebhookPayloadto be called before processing any data, returning a 400 error for invalid signatures. - Capability inventory: The skill performs local database operations (
upsertUser,upsertGroup) and SDK calls (listDirectoryUsers). - Sanitization: Signature verification ensures data integrity and authenticity from the provider.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and developer tools at
scalekit.comandmcp.scalekit.com. These are vendor-owned resources relevant to the skill's purpose.
Audit Metadata