Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly transparent about managing the user's SAP Concur data, but it exposes broad authenticated GraphQL mutation capability for financial/workflow data that is not clearly bounded to the stated scope.
Review before installing. This skill can use your active Concur session to read and change expense/report/travel data, including irreversible deletions and submissions. Only use it if you trust the external MCP package and are comfortable with a raw GraphQL escape hatch; require explicit review of every preview before confirming any write.
The skill says approving other people's reports is out of scope, yet the escape-hatch documentation admits some approval-related mutations are not refused. This means an agent could be steered into performing managerial or third-party approval actions that the skill claims to prohibit, enabling unauthorized workflow changes with real financial and compliance consequences.
The manifest says the skill triggers on phrases like "expense report," "submit my expenses," "what's unsubmitted," and "my upcoming trip," plus "any request to read or change the user's own Concur expense or travel data." Several of these phrases are common natural-language requests and the catch-all clause lacks clear boundaries or exclusion conditions, increasing the chance of accidental invocation.
The skill manifest scopes usage to the user's own Concur data, but the documented GraphQL escape hatches explicitly expose lower-level operations beyond the curated tool surface. That creates a policy/implementation gap: an agent can be induced to use generic GraphQL interfaces to access or mutate unsupported data, defeating the manifest's narrower safety boundary.
No suspicious patterns detected.
