Security audit

Shift Scheduler

Security checks for vulnerabilities and agentic risk

Overview

This scheduling skill is mostly purpose-aligned, but it needs review because it can handle sensitive staff schedule data while recommending public Google Sheets sharing and leaving access/action scope loose.

Review before installing in any real workplace setting. Use restricted service-account or authenticated access for Sheets and calendars, avoid public-read schedule links, limit the skill to approved schedule files/accounts, require manager confirmation before schedule changes or notifications, and store exported JSON securely because it may contain employee and operational data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/schedule-formats.md:31
Finding: Public-Read Schedule Sharing Can Expose Staff and Operational Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/parse_schedule.py:47
Finding: Unpinned Dependency Installation Guidance Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents an operational scheduling assistant for end users, implying conversational support and workflow actions such as answering 'what's my shift,' managing swaps, leave, reminders, and on-call routing. The supplied code does something much narrower and different: it ingests schedule data from files, normalizes fields, parses informal text schedules, validates some scheduling constraints, and emits JSON. While this is related to scheduling as a supporting backend/parser, it does not implement the primary assistant behaviors described. Therefore the description materially overstates and misrepresents the actual functionality.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes file-based schedule ingestion and a parsing script, but it does not declare any explicit tool scope or permissions. That creates an authorization gap where file read/write behavior may be available without clear limitation, increasing the risk of overbroad filesystem access or accidental exposure/modification of schedule and staff data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Using the standalone trigger phrase "schedule" is overly broad and can cause the skill to activate for unrelated conversations. Unintended activation may expose employee scheduling context, route sensitive requests to the wrong workflow, or cause the agent to process leave/swap actions when the user meant something else.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Google Sheets section explicitly suggests using a public-read link for staff scheduling data, which can expose employee names, shift times, roles, and manager contact details to anyone with the link or broader unintended audiences. In a shift-scheduling skill, this context increases the risk because the data is operationally sensitive and may enable privacy violations, social engineering, or stalking of staff.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings and parsing logic are explicitly tailored to Chinese text, such as the docstring Parse informal Chinese text schedule, Chinese date patterns, and Chinese field aliases. This imposes a locale-specific behavior without user opt-in or a clearly documented region-specific justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The example schedule content and field values are presented in Chinese, but the document does not state that the skill is intentionally limited to Chinese-language schedules or provide any language/locale choice. Under the language policy, forcing a specific language without opt-in or justification can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code writes structured staff schedule data, including employee names and IDs, to disk via Path(args.output).write_text(...). Although the script prints a success message after writing, there is no user-facing warning in the file about handling potentially sensitive personnel data when exporting schedules.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.