ClawHub
Back to skill

Security audit

Bamboohr Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is legitimate BambooHR automation, but it can make live HR changes without built-in final confirmation steps.

Install only if you intend to let the agent access BambooHR HR data through Rube. Use the least-privileged BambooHR account available, avoid broad employee or dependent queries unless needed, and require a human review before any employee update or time-off create, approve, deny, or cancel action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes instructions for updating employee profile fields but does not require an explicit confirmation or user-facing warning before making changes to HR records. In an HR context, silent or ambiguous execution can lead to unauthorized modifications, payroll/benefits errors, and audit or compliance issues affecting real employees.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill describes creating and especially updating time-off requests, including approving, denying, or cancelling them, without a clear warning that these are consequential HR actions. Because these actions can affect employee compensation, scheduling, and managerial decisions, an agent following these instructions could perform impactful changes without sufficient human verification.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.