Security audit
Security checks for vulnerabilities and agentic risk
The skill is not overtly malicious, but it asks agents to work with HRIS and employee training data without enough privacy and control guidance.
Review before installing in any real workplace environment. Only use it with explicit authorization, least-privilege access, minimized or anonymized employee data, and legal/privacy review for compliance modules or HRIS-connected workflows.
The skill description is broad and does not define clear activation boundaries, approved use cases, or disallowed tasks. In a corporate onboarding and HR context, this increases the chance the agent will be invoked for sensitive employee-data processing or compliance-related decisions outside its intended scope, leading to overreach and unsafe handling of regulated information.
The skill advertises HRIS integration and training analytics involving employee onboarding, completion, and engagement metrics, but it provides no warning or safeguards for handling HR-related or personal employee data. This is dangerous because users may supply sensitive PII, performance data, or compliance records without guidance on minimization, consent, retention, access control, or legal review, increasing privacy, insider-risk, and regulatory exposure.
No suspicious patterns detected.
