paylocity
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches connector details and API specifications from official vendor domains including apideck.com and paylocity.com.
- [CREDENTIALS_UNSAFE]: The documentation correctly guides users to utilize environment variables and the managed Apideck Vault authentication service rather than hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external HRIS data, creating an attack surface where data from Paylocity could influence agent behavior.
- Ingestion points: Employee records, payroll data, and time-off requests retrieved from the Apideck HRIS API as described in SKILL.md.
- Boundary markers: No specific delimiters or instruction-ignore warnings are included in the prompt templates or code examples in SKILL.md.
- Capability inventory: Includes network communication via the @apideck/unify SDK and curl commands in SKILL.md.
- Sanitization: The skill does not implement or describe input validation or sanitization for the external data it processes in SKILL.md.
Audit Metadata