paychex

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from Paychex HRIS records, creating a surface for potential indirect prompt injection if the source data contains malicious instructions. * Ingestion points: The skill uses apideck.hris.employees.list and the Apideck Proxy API (SKILL.md) to fetch employee, department, and payroll data. * Boundary markers: The current documentation and examples do not define specific delimiters or instructions to the agent for separating untrusted data from system instructions. * Capability inventory: The skill utilizes network operations via the @apideck/unify SDK and curl to interact with Apideck and Paychex APIs. * Sanitization: There is no evidence of data sanitization or validation logic applied to the external content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 11:55 AM