Security audit
Security checks for vulnerabilities and agentic risk
This skill is read-only and openly Workday-focused, but it gives broad access to highly sensitive HR data through a live signed-in browser session with limited scoping safeguards.
Install only if you are authorized to use automation against your employer's Workday tenant and understand that the agent may retrieve sensitive HR information visible to your browser session. Treat other employees' compensation, benefits, performance, and profile data as restricted, and prefer explicit, narrowly scoped requests.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
.mcp.json (project) or ~/.claude/mcp.json (global):
{
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
[ContextMint Bridge releases](https://github.com/nullnet-app/contextmint-bridge/releases):
- **Chrome:** unzip the chrome zip and load it as an unpacked extension in
`chrome://extensions` (Developer mode on).
- **Safari:** not available yet — it will ship inside the ContextMint app, which has
no public download link. Use Chrome for now.
The trigger phrases are broad enough to activate on requests involving highly sensitive HR data such as compensation, benefits, and performance, including data about other employees. In a read-only Workday skill, overbroad activation increases the chance the agent will access or surface private records without an explicit, well-scoped user request or privacy check.
The description emphasizes broad access to worker profiles, compensation, benefits, and performance but does not clearly warn users that retrieving other employees' HR data may be sensitive, policy-restricted, or inappropriate. In this context, the absence of a strong warning makes misuse more likely because the skill normalizes access to third-party personnel records through an already-authenticated browser session.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Three of this server's ten tools take `view: "compact" | "full"` —
**`workday_get_task`**, **`workday_open_app`** and
**`workday_get_worker_task`** — and on all three **`compact` is the DEFAULT**.
The slim rung is what you get without asking for it.
Those three are the deep reads: the ones that follow a hub down to its child
cards, or open one named item on a profile, and can therefore come back with a
No suspicious patterns detected.