sage-hr

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external HR and ATS data, such as employee records and time-off requests, into the agent's context.
  • Ingestion points: The skill uses methods like apideck.hris.employees.list() to fetch data from Sage HR via Apideck's unified API.
  • Boundary markers: The provided documentation does not specify the use of delimiters or instructions to ignore potential commands embedded within the retrieved HR data.
  • Capability inventory: The skill performs network operations via the @apideck/unify SDK and curl commands to interact with the unify.apideck.com API.
  • Sanitization: There is no mention of specific sanitization or filtering logic applied to the data retrieved from the external Sage HR service.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 11:54 AM