The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the configuration of an external MCP server at https://rube.app/mcp.
The domain rube.app is an external community resource and is not recognized as a trusted organization or well-known service in the security baseline.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from BambooHR (such as employee profiles and directory information) which may be controlled by end-users. Malicious content within the HR system could potentially influence agent behavior.
Ingestion points: Employee data is ingested via tools such as BAMBOOHR_GET_ALL_EMPLOYEES and BAMBOOHR_GET_EMPLOYEE (File: SKILL.md).
Boundary markers: The skill includes a dedicated "HR data boundaries" section providing instructions to the agent to limit data access, verify IDs, and stop operations without explicit approval.
Capability inventory: The skill possesses significant capabilities for modifying state, including BAMBOOHR_UPDATE_EMPLOYEE and BAMBOOHR_CREATE_TIME_OFF_REQUEST (File: SKILL.md).
Sanitization: No automated sanitization or escaping of the ingested API data is defined in the instructions; the skill relies on manual instructional guardrails.

bamboohr-automation