ClawHub

Bamboohr Automation

Security checks across malware telemetry and agentic risk

Overview

This BambooHR skill has a legitimate purpose, but it can change sensitive HR records and time-off decisions without clearly requiring final user confirmation.

Install only if you intend to let the agent work with BambooHR HR data. Use a least-privilege BambooHR/Rube connection, avoid broad employee or dependent queries unless needed, and require explicit confirmation before any employee update, time-off request creation, approval, denial, or cancellation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This skill instructs the agent to update employee profile fields in a live HR system but does not require explicit user confirmation or a warning that the action changes authoritative HR records. In an HR context, silent modifications can alter payroll-adjacent data, contact details, or employment metadata and create audit, compliance, and operational risk if triggered from ambiguous or mistaken requests.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes creating and modifying time-off requests, including approve/deny actions, without an explicit warning that these are live workflow operations with business consequences. An agent following these instructions could submit or change leave requests based on incomplete or misinterpreted user input, affecting staffing, payroll, and employee records.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal