Sf Scraper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:03 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed SuccessFactors HR scraper, but it can collect broad sensitive employee data from the user's logged-in session without strong scope controls.

Review this skill carefully before installing. It should only be used by authorized HR or business users, and only for specific employee fields that the user explicitly asks for. Avoid using it for compensation, documents, performance, leave, home contact details, or screenshots unless there is clear authorization and a business need.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill description presents the capability as a routine employee lookup but omits a clear warning that the workflow may collect sensitive HR data such as personal details, compensation, and employment records. This undermines informed user consent and increases the chance that operators invoke the skill without understanding the privacy implications of scraping a live HR profile.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The workflow directs the agent to traverse tabs including documents, performance history, goal plans, and time-off data, which are unrelated to a basic employee-details lookup and can expose especially sensitive HR records. In the context of browser automation against a logged-in HR system, these instructions materially increase the risk of overcollection and unauthorized access to confidential personnel information.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- **NEVER use OData, REST API, or any programmatic endpoint.** Pure browser scraping only.
- **Always use `profile="chrome"`** — never `profile="openclaw"` (need the user's auth session).
- **Be patient** — SF can be slow. Always verify page state with snapshots before extracting.
- **Don't navigate away** from SF without warning the user.
- **Respect permissions** — if data is restricted/hidden in the UI, it's restricted for a reason. Don't try to circumvent.
- **Screenshot fallback** — if snapshot (accessibility tree) doesn't capture visible text, use `browser(action="screenshot", profile="chrome")` to see the rendered page visually and extract from the image.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions require use of an authenticated Chrome profile tied to the user's live SuccessFactors session but do not prominently warn that all actions occur with the user's current HR permissions. That makes accidental access, disclosure, or navigation under the user's authority more likely, especially in a system containing sensitive personnel data.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill's workflow expands far beyond a narrow employee lookup and explicitly instructs extraction of sensitive HR categories such as personal, employment, compensation, contact, and organizational data. This creates a data-minimization failure: a user asking for a simple identifier lookup could trigger broad collection of highly sensitive employee information from a live authenticated session.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill contains conflicting instructions: earlier steps encourage broad tab navigation and reveal-more behavior, while a later rule says not to scrape everything when the user asked for only a name. Such ambiguity is dangerous because agents often follow the more operationally specific steps, leading to overscraping before the limiting rule is applied.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The screenshot fallback can capture far more visible HR information than the requested fields, including adjacent profile sections, popups, and other on-screen sensitive data, yet the skill provides no privacy warning or scoping guidance for this collection method. In a live HR interface, screenshots materially increase the risk of unnecessary collection and downstream disclosure of confidential employee information.

Static analysis

No suspicious patterns detected.