Back to skill

Security audit

Analyste Du Travail

Security checks for vulnerabilities and agentic risk

Overview

This is a French workplace-transformation template skill with no executable code, but users should handle interview and observation notes as sensitive workplace data.

Install only if you intend to use French workplace-diagnostic templates. Before using it with real employees, define notice/consent, minimize identifiable details, pseudonymize where possible, avoid unnecessary sensitive personal notes, and store outputs in approved internal systems with clear access and retention rules.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Le nom, la description et le contenu opérationnel du skill sont entièrement rédigés en français et décrivent la compétence comme devant produire ses livrables dans ce cadre linguistique. Cela constitue une contrainte de langue implicite sans indication qu'un autre langage est possible ou que l'utilisateur peut choisir sa langue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The interview template explicitly captures identifiable employee information such as name, role, and tenure, and the introduction promises confidentiality without giving any guidance on lawful basis, minimization, storage, access control, or retention. In a banking transformation context, these notes can contain sensitive workplace assessments and become privacy, HR, or internal surveillance data if mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template directs interviewers to record verbatims, atmosphere, weak signals, and cross-interview links, which can create highly sensitive qualitative profiles about employees without any warning about sensitivity or safeguards. In practice this may capture reputationally harmful statements, grievances, health-related hints, or managerial assessments that are easy to re-identify even after superficial anonymization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file contains only French-language instructions and templates, with no indication that the skill is intentionally limited to French-speaking users or a specific regional context. Under the policy rule for language/locale constraints, forcing a single language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file is natural-language content, and it consistently prescribes a single language/locale for use. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file contains only French-language instructions and labels, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The policy allows locale constraints only when the skill offers a choice or clearly documents that the skill is intended for a specific region or audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing instructions exclusively in French, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing instructions and examples exclusively in French, which can amount to a language/locale policy issue when no opt-in or alternative language is provided. The content does not state that the template is intentionally limited to a French-speaking audience or region-specific use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.