implement-scim

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a webhook endpoint that ingests untrusted data from external directory providers.
  • Ingestion points: Data enters via the POST /webhooks/scalekit route.
  • Boundary markers: The skill includes a mandatory guardrail requiring verifyWebhookPayload to be called before processing any data, returning a 400 error for invalid signatures.
  • Capability inventory: The skill performs local database operations (upsertUser, upsertGroup) and SDK calls (listDirectoryUsers).
  • Sanitization: Signature verification ensures data integrity and authenticity from the provider.
  • [EXTERNAL_DOWNLOADS]: The skill references official documentation and developer tools at scalekit.com and mcp.scalekit.com. These are vendor-owned resources relevant to the skill's purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 08:07 AM
Security Audit — agent-trust-hub — implement-scim