people-hr
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing employee and time-off data from the People HR API. This untrusted data could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Data retrieved via
apideck.hris.employees.listas described inSKILL.md. - Boundary markers: None explicitly defined in the examples.
- Capability inventory: SDK methods and curl commands that can read data and perform network requests.
- Sanitization: Not specified in the skill content.
- [EXTERNAL_DOWNLOADS]: References the official
@apideck/unifypackage and related vendor SDKs for integration. These are legitimate resources provided by the skill author. - [COMMAND_EXECUTION]: Includes
curlcommand examples used to query the Apideck API for connector coverage and proxy requests. These are restricted to API interactions and do not involve execution of remote scripts.
Audit Metadata