Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Tempo MCP connector, but it materially understates that the configured token may access or change other users' worklogs, team data, and timesheet approvals.
Review before installing. Use a least-privilege Tempo token, confirm exactly which users, teams, accounts, and approval actions that token can access, and treat the documentation's 'own account only' claim as inaccurate. Do not store the token in shared repositories or chats, and require explicit confirmation for any create, update, delete, submit, approve, reject, reopen, or recall action.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Add to .mcp.json in your project or ~/.claude/mcp.json:
{
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Passing `view` to one of those is not an error and does not fail: the tool
does not declare it, so zod drops the unknown key and the call runs exactly as
it would have. You get no warning, so do not treat a successful call as
evidence the rung was honoured.
## Workflows
The skill's terms state it 'cannot' access other users' worklogs or time entries, but the documented tools explicitly support querying team worklogs, user worklogs, timesheet approvals by team, and reviewer actions on other users' timesheets. This misleading claim can cause operators to underestimate the data-access scope and approve use in contexts where broader access should be restricted or reviewed.
The natural-language policy claim directly contradicts the listed capabilities, which include access to worklogs by user/team and timesheet approval workflows affecting others. Such contradictions are dangerous because they create a false trust signal around privacy boundaries and can mislead reviewers, users, or downstream agents about what data may be exposed or changed.
The trigger description is broad enough to activate on many generic Jira/Tempo-related requests, increasing the chance the skill is invoked when the user did not intend to access or modify Tempo data. In a connector with both read access to team data and confirmation-gated write actions, overbroad activation raises the risk of unnecessary data exposure or confusing tool use.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Response shape (`view`)
Every read tool takes `view: "compact" | "full"`, and **`compact` is the
default** — you get the slim rung without asking for it. That is 30 of this
server's 48 tools; the seventeen confirmation-gated writes and `tempo_healthcheck`
have no `view`.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
tempo_get_periods(from: "2026-03-01", to: "2026-03-31") # find the period boundaries
tempo_approve_timesheet(accountId, from: "2026-03-01", to: "2026-03-31", comment: "LGTM")
# → on a client without confirmation prompts: status "confirmation-required", a preview, and a confirmToken
tempo_approve_timesheet(accountId, from: "2026-03-01", to: "2026-03-31", comment: "LGTM", confirmToken: "<token>")
No suspicious patterns detected.