HalaOS HR Copilot

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:07 AM UTC
• Version: 2.1.0

Overview

This HR skill is purpose-aligned, but it should go to Review because broad prompts and cloud/API guidance can expose or change sensitive employee and payroll data without clear confirmation steps.

Install only if you are authorized to access the connected HalaOS tenant and are comfortable with an agent handling sensitive employee, attendance, leave, payroll, compliance, and risk data. Use a least-privileged API key, avoid broad casual prompts in shared chats, review any payroll, government form, approval, or rejection action before execution, and prefer a pinned MCP server version instead of @latest.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:279

Finding

Unpinned Remote MCP Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:279
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

markdown

- MCP Server: `go install github.com/tonypk/aigonhr/cmd/mcp@latest`

Technical Analysis

The documented installation command retrieves, builds, and installs the mutable latest version of a remote Go module. It does not pin a reviewed release or commit and provides no checksum or signature verification.

Consequently, the installed MCP server can differ from the component that existed when this Skill was audited. If the upstream repository, release process, dependency chain, or maintainer account is compromised, a subsequent installation can execute attacker-controlled code under the privileges of the user running the command.

The MCP server is also configured to receive HALAOS_API_KEY, increasing the sensitivity of the dependency. A malicious version could read that credential and use it to access the connected HalaOS instance.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its dependency supply chain.
2. The attacker places malicious code in the revision resolved by @latest.
3. A user follows the Skill documentation and runs:

   shell

   go install github.com/tonypk/aigonhr/cmd/mcp@latest
   

4. Go retrieves and builds the modified remote source.
5. The resulting binary executes with the installing user's privileges.
6. When configured as documented, the binary receives HALAOS_API_KEY and can access or exfiltrate data available to that credential.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on the environment, this could expose the HalaOS API credential, local files accessible to the user, employee records, attendance information, leave data, payroll information, and other ...[truncated 195 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, immutable semantic version or commit hash.
2. Publish expected checksums and require users to verify downloaded release artifacts.
3. Sign releases and document signature verification.
4. Maintain a controlled update process that reviews changes before advancing the pinned version.
5. Run the MCP server with a dedicated, least-privileged operating-system account or sandbox.
6. Issue narrowly scoped HalaOS API keys and rotate them if the installed component or upstream supply chain may have been compromised.
7. Prefer reproducible builds and a dependency lock or verification mechanism for transitive modules.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:75

Finding

Broad Conversational Triggers Cause Excessive Sensitive HR Data Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:75-98
Vulnerability Type: Excessive privileged data retrieval and insufficient intent validation
Risk Level: Medium

Vulnerable Instructions:

markdown

**Trigger:** User says "good morning", "briefing", "what's happening today", or any start-of-day greeting.

**Action:** Call these tools in sequence:
1. `get_dashboard_stats` — headcount, attendance, pending items
2. `list_leave_requests` with `status=pending` — pending approvals
3. `get_compliance_alerts` — overdue filings, expiring documents

markdown

**Action:**
1. `list_leave_requests` with `status=pending` — show pending requests
2. `list_all_leave_balances` — get all employee balances (admin only), cross-reference with pending requests
3. If user needs leave type IDs, call `list_leave_types` first
4. If user asks about team coverage, call `get_attendance_records` for that date

The associated response format also directs the Agent to expose identifiable leave information:

markdown

- Pending leave: N requests waiting (list names + types)

Technical Analysis

An ordinary start-of-day greeting is treated as authorization to query several live HR datasets. These queries include pending leave requests and privileged compliance alerts, even though the user may only have intended a greeting.

The leave-management workflow similarly directs the Agent to retrieve all employees' leave balances through an administrator-only tool rather than first limiting the request to a specific employee, team, or organizational scope. The instructions then encourage displaying employee names and leave types.

Although SKILL.md:61 documents server-side role restrictions, role authorization alone does not establish user intent or data necessity. A Manager or Administrator may technically be authorized to access the records while still causing unintended disclosure by invoking the workflow ...[truncated 1324 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not treat a generic greeting as consent to access live HR records.
2. Require an explicit briefing request before invoking organization-level tools.
3. Ask for confirmation before retrieving compliance alerts, named leave requests, or organization-wide balances.
4. Default briefing responses to aggregate counts and avoid employee names or leave types unless explicitly requested and authorized.
5. Replace list_all_leave_balances with employee-scoped or team-scoped queries whenever possible.
6. Verify the user's role and organizational scope before every sensitive tool call rather than relying only on static workflow instructions.
7. Apply field-level output filtering and redact salary, leave, health-related, contact, and compliance details not required by the request.
8. Warn users before presenting sensitive information in group channels or other shared contexts.
9. Log privileged access for audit purposes without placing sensitive returned values in general application logs.
10. Enforce least-privilege scopes and tenant isolation at the MCP server and API layers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages use of cloud endpoints that access highly sensitive HR data such as employee records, attendance, payroll, org charts, and behavioral risk indicators, but it provides no privacy warning, consent guidance, or data-handling disclosure. In an agent setting, this can cause users to unknowingly transmit regulated personal and employment data to a remote service, increasing the risk of privacy violations, policy noncompliance, and unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises high-impact actions like running payroll, generating government forms, and approving or rejecting requests, but gives no caution about authorization, confirmation, or review requirements. In a conversational agent, this creates a realistic risk of accidental or unauthorized operational actions affecting compensation, compliance filings, and employee workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The morning-briefing trigger includes broad everyday greetings such as 'good morning', which can cause the skill to activate and pull sensitive HR data during normal conversation without a clear, deliberate user request. In an HR context, this raises the risk of unintended access to attendance, leave, and compliance information, especially because the prescribed workflow chains multiple data-retrieval tools automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Several scenario triggers are extremely broad, including terms like 'summary', 'how are we doing', and 'team health', which may match ordinary conversation and automatically invoke sensitive HR analytics such as flight-risk and compliance alerts. Because these workflows can surface confidential personnel and organizational-risk data, unclear invocation boundaries materially increase the chance of accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs the agent to store company context in a local config file but does not warn the user that this data will be persisted on disk. While the stored fields are not highly sensitive by themselves, undisclosed persistence can create privacy and transparency issues and may surprise users in managed or shared environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.