Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only HR leadership skill with sensitive but purpose-aligned HR guidance and no hidden execution, persistence, or data exfiltration behavior.
Install only if you intend to use it for HR workflows. Treat employee analytics, immigration/work-authorization dates, compensation, manager notes, and termination data as confidential; keep access limited to authorized HR/legal/security personnel and use human review for employment decisions.
The 'When to Use' section says the skill applies whenever a user needs HR leadership for broad areas like hiring, compensation, terminations, compliance, or workforce planning. It does not define specific trigger phrases, scope constraints, or negative examples, which could cause unintended invocation for many ordinary workplace questions.
This section describes attrition risk scoring using highly sensitive employee data, including manager notes sentiment, activity patterns, engagement scores, and compensation comparisons, but provides no privacy, fairness, access-control, or bias-mitigation guidance. In an HR skill context, these signals can enable invasive profiling or unfair employment decisions if surfaced broadly or used without governance, making the omission a real security and privacy weakness.
The proactive alerts section includes especially sensitive topics such as post-termination account deactivation, visa/I-9 expiration, pending termination documentation, and employee flight-risk scoring, yet gives no warning about confidentiality, access restrictions, or safe handling. In a CHRO/HR operations skill, these alerts could expose immigration status, termination events, or privileged access-control information to the wrong audience, increasing privacy, insider-risk, and discrimination concerns.
SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. This line references English-language requirements, but in context it is warning against discriminatory phrasing rather than mandating a locale, so confidence is low.
No suspicious patterns detected.
