onelogin
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe practices by instructing the use of environment variables for managing API keys and application IDs in code examples.
- [EXTERNAL_DOWNLOADS]: The skill references the official
@apideck/unifyNode.js package and provides links to verified vendor domains for API specifications and documentation. - [INDIRECT_PROMPT_INJECTION]: The skill documents how to ingest HRIS data from OneLogin, creating an attack surface. 1. Ingestion points: Data is retrieved via
apideck.hris.employees.listand Proxy API calls as described inSKILL.md. 2. Boundary markers: No specific delimiters or warnings regarding untrusted content are included in the examples. 3. Capability inventory: The agent is taught to synchronize and list employee, department, and payroll data. 4. Sanitization: No explicit data sanitization or validation steps are outlined for handling the retrieved OneLogin records.
Audit Metadata