sapling
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill's instructions or configuration files.
- [EXTERNAL_DOWNLOADS]: The skill references official and well-known domains for its API operations (apideck.com, saplinghr.com). These references are legitimate and do not involve untrusted remote code execution.
- [CREDENTIALS_UNSAFE]: The skill correctly handles authentication by directing users to use environment variables for API keys and utilizing Apideck Vault for secure credential management, rather than hardcoding sensitive information.
- [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by fetching data from external HRIS records. (Ingestion points: apideck.hris.employees.list in SKILL.md; Boundary markers: not explicitly defined; Capability inventory: instructional content with no dangerous system operations; Sanitization: relies on the implementation of the @apideck/unify SDK).
Audit Metadata