Employee Reminder Ops

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:49 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with employee reminder reporting, but its bundled scripts can post employee data to a real-looking default Discord channel with production-send automation.

Review this before installing in production. Replace all bundled spreadsheet, account, and Discord channel defaults with your own explicit configuration, use a test channel first, remove unnecessary Drive authorization, avoid broad .env sourcing where possible, and only enable scheduled prod-send after confirming the destination audience is approved for employee birthday and event data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/plan-a-demo.js:8
• Finding: Hardcoded production identifiers can route employee data to an unintended Discord channel<![CDATA[ ## Vulnerability Details **File Location**: `scripts/plan-a-demo.js:8-13`, `scripts/plan-a-demo.js:123-124`, `scripts/plan-a-demo.js:216-217`, `scripts/plan-a-demo.js:240-249` **Vulnerability Type**: Hardcoded production routing identifiers and unsafe default configuration **Risk Level**: High ### Vulnerable Code ```js const CONFIG = { spreadsheetId: process.env.PLAN_A_SHEET_ID || '17JU1m6rBOhlD7vqSTrMOSPcEQehO04HnYg7oMeDXnn8', staffTab: process.env.PLAN_A_STAFF_TAB || 'Trang tính1', eventsTab: process.env.PLAN_A_EVENTS_TAB || 'NgayDacBiet', discordChannelId: process.env.DISCORD_CHANNEL_ID || '1483444824895000697', discordBotToken: process.env.DISCORD_BOT_TOKEN || '', remindDaysDefault: Number(process.env.PLAN_A_REMIND_DAYS || 3), runDate: process.env.PLAN_A_RUN_DATE || '', gogAccount: process.env.GOG_ACCOUNT || '[e-mail]', ``` The report includes employee names and departments: ```js for (const item of data.birthdaysToday) lines.push(`- 🎂 Sinh nhật: ${item.name} (${item.dept || 'Chưa rõ bộ phận'})`); for (const item of data.eventsToday) lines.push(`- 🎉 Sự kiện: ${item.name}${item.owner ? ` — phụ trách ${item.owner}` : ''}`); ``` The resulting report is transmitted to the configured or default Discord channel: ```js async function sendDiscordMessage(content) { if (!CONFIG.discordBotToken) throw new Error('Thiếu DISCORD_BOT_TOKEN'); const res = await fetch(`https://discord.com/api/v10/channels/${CONFIG.discordChannelId}/messages`, { method: 'POST', headers: { Authorization: `Bot ${CONFIG.discordBotToken}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ content }), }); ``` ### Technical Analysis Sending reminder reports to Discord is part of the declared functionality, and the script uses Discord's official HTTPS API. The security problem is that the spreadsheet ID, Google account, and Discord channel ID use real-looking hardcoded defaults rather than mandatory de ...[truncated 1802 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all real spreadsheet, account, and channel identifiers from the source code. 2. Require `PLAN_A_SHEET_ID`, `GOG_ACCOUNT`, and `DISCORD_CHANNEL_ID` to be explicitly configured. 3. Validate required configuration before reading data or sending a message, and terminate safely if any value is missing. 4. For manual sends, display the destination channel and require explicit confirmation unless a noninteractive production flag is intentionally supplied. 5. Use clearly invalid placeholders in examples rather than operational identifiers. 6. Restrict the Discord bot to only the intended server and channel, with message-send permission only. 7. Minimize report contents to information necessary for the reminder workflow and establish organizational approval for processing employee birthday data. 8. Keep invalid-record details disabled by default and avoid posting employee codes or raw malformed values into group chats. 9. Add deployment tests that verify there are no fallback production destinations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/deployment.md:54
• Finding: Deployment instructions request unnecessary Google Drive authorization<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:54-58` **Vulnerability Type**: Excessive OAuth service authorization **Risk Level**: Medium ### Vulnerable Code ```bash gog auth credentials /path/to/client_secret.json gog auth add [e-mail] --services sheets,drive ``` ### Technical Analysis The reviewed implementation only invokes the Sheets functionality through the following operation: ```js return runGog(['sheets', 'get', CONFIG.spreadsheetId, range, '--json']).values || []; ``` No runtime behavior in the supplied scripts uses Google Drive operations. Nevertheless, the deployment instructions tell users to authorize both Sheets and Drive services. Requesting authorization for an unused service violates least privilege. The exact OAuth scopes ultimately granted depend on the behavior and configuration of the external `gog` CLI, but enabling the Drive service creates an unnecessary authorization surface beyond the Skill's demonstrated runtime needs. ### Attack Path 1. A user follows the deployment documentation. 2. The user runs `gog auth add ... --services sheets,drive`. 3. The runtime receives authorization for the Drive service in addition to Sheets. 4. If the local account, token store, `gog` executable, or runtime environment is later compromised, the unnecessary Drive authorization may be abused. 5. The attacker can exercise whatever Drive permissions were granted by the external authorization flow, even though this Skill only needs to read spreadsheet data. ### Impact Assessment The excessive authorization can broaden the impact of a compromised Google credential or local runtime from the required spreadsheet operations to the Drive permissions granted by `gog`. The precise accessible operations cannot be established from the repository alone because the external CLI's generated OAuth scopes are not included. No code in the audited project directly attempts to enumerate, modify, or delete Dr ...[truncated 96 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `drive` from the documented authorization command unless a separately implemented feature requires it. 2. Request only the narrowest read-only Sheets authorization supported by `gog`. 3. If Drive access becomes necessary, document the exact feature, scopes, accessed resources, and security rationale. 4. Use a dedicated Google account or service identity restricted to the required spreadsheet rather than a broadly privileged personal account. 5. Periodically review and revoke obsolete OAuth grants. 6. Document where `gog` stores tokens and require restrictive local file permissions for its credential store. 7. Add a deployment verification step that confirms the authenticated identity can access only the intended spreadsheet resources. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/deployment.md:28
• Finding: Documentation installs an unpinned global npm dependency<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:28-32`, `references/clawhub.md:3-7`, `references/clawhub.md:23-26` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g clawhub ``` The same unpinned installation is repeated in the ClawHub installation instructions: ```bash npm i -g clawhub clawhub install employee-reminder-ops ``` ### Technical Analysis The command installs the latest package version available under the `clawhub` npm package name and places it in the user's global npm environment. The documentation does not pin an audited version, provide an integrity hash, identify an expected publisher or registry, or use a lockfile. Because npm package resolution is mutable, the code executed at installation time may differ from the version that existed when this Skill was audited. Package lifecycle scripts can execute during installation. A package takeover, registry compromise, or unsafe future release could therefore introduce code that was not included in this repository or security review. There is no evidence in the audited files that the current `clawhub` package is malicious. This finding concerns the unsafe and unreproducible dependency acquisition method. ### Attack Path 1. An attacker compromises the npm package, publisher account, registry path, or a future package release. 2. A user follows the Skill documentation and runs `npm i -g clawhub`. 3. npm resolves the current mutable package version rather than a reviewed version. 4. npm downloads the compromised package and may execute its lifecycle scripts. 5. The malicious package gains the permissions of the user running npm and is installed into the global npm environment. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the installing user. Potential impact includes reading user-accessible files, accessing environment variables or l ...[truncated 367 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific reviewed version, such as `clawhub@<audited-version>`. 2. Document the expected npm registry, package publisher, and package provenance. 3. Verify package integrity or signed provenance where supported. 4. Prefer a project-local, lockfile-controlled installation over a global installation when practical. 5. Review package lifecycle scripts before recommending installation. 6. Use `npm ci` with a committed lockfile for reproducible dependency resolution where the deployment model permits it. 7. Establish an update process that reviews new versions before changing the pinned version. 8. Advise users not to run the installation command with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is specific: a Google Sheets-driven employee reminder and reporting workflow involving staff/event schemas, scheduled jobs, and chat routing. The provided code chunk does not implement or demonstrate any of that functionality directly. Instead, it is a thin launcher script that loads environment variables and runs an external Node script in 'prod-send' mode. Because the visible behavior is primarily orchestration of an unspecified production send operation, and there is no evidence in this chunk of Google Sheets access, reminder/report generation, or Telegram/Discord routing, the code does not accurately represent the declared purpose based on the supplied snippet.

Credential Access

High

• Category: Privilege Escalation

Content

Ví dụ flow:

```bash
gog auth credentials /path/to/client_secret.json
gog auth add [e-mail] --services sheets,drive
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill metadata does not declare any tool restrictions even though the workflow clearly involves environment access and outbound network actions to Google Sheets and chat platforms. Without explicit scope boundaries, an agent may invoke broader capabilities than intended, increasing the chance of secret exposure or unauthorized message sending during installation or execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document provides commands that will send real messages to a live Discord channel using a bot token, but the warnings before those commands are weak and do not clearly foreground the external side effect at the point of execution. In an operational skill that reads real Google Sheets data and posts into team chats, this can cause unintended disclosure, spam, or accidental production actions during testing or migration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The plan explicitly routes automated reports to a fixed Discord channel but does not mention any consent, audience restriction, or data-minimization control. Because the workflow processes employee birthdays and special events, this can expose internal personnel data to a broader chat audience than intended, especially if the channel membership is not tightly controlled.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The deployment guide instructs operators to configure Google auth and chat bot tokens but does not explicitly warn that these credentials must be kept out of committed files, chat transcripts, logs, and shared screenshots. In an ops-focused skill that routes messages to Telegram/Discord and uses Google access, omission of credential-handling guidance materially increases the chance of accidental secret exposure during setup or troubleshooting.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document prescribes tab names and required column headers entirely in Vietnamese, including a suggested default tab name and all schema labels. Because no opt-in, alternative locale, or justification for a Vietnam-specific deployment context is provided, this appears to enforce a specific language/locale in natural-language instructions.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file contains operational instructions in Vietnamese (for example, 'Hỗ trợ hiện tại' and 'macOS là môi trường hiện tại đã test Plan A nhiều nhất') while other parts are in English. That imposes a language expectation on users without any stated opt-in, language selection, or justification for a locale-specific audience.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Scheduler
- use `launchd`
- example plist already bundled in scripts

## Notes
macOS là môi trường hiện tại đã test Plan A nhiều nhất.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Scheduler
- use `launchd`
- example plist already bundled in scripts

## Notes
macOS là môi trường hiện tại đã test Plan A nhiều nhất.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The headings and instructions from L03 onward are entirely in Vietnamese, which imposes a language choice on users without opt-in. Under the policy, language-specific guidance should either offer a choice or clearly document why the locale restriction is necessary.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown mixes English headings with core operational instructions in Vietnamese, such as setup and scheduler guidance. Because the file does not state that the skill is intended only for Vietnamese-speaking users or offer an alternate language, it may violate language/locale policy requiring user choice or clear justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: In send and prod-send modes, the script transmits employee birthdays, department information, event details, and optionally invalid-row details to a Discord channel without any interactive confirmation, recipient validation, or data-classification guardrail. In the context of an internal operations workflow, this can cause accidental disclosure of employee-related information to the wrong channel or broader audience, especially because channel IDs and tokens are environment-driven and the feature is designed for automated scheduled execution.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script silently sources a local .env file with set -a, exporting all variables into the process environment without any notice or validation. In an agent-skill context, this is dangerous because it can implicitly pull in sensitive credentials or unsafe runtime settings from the local workstation, broadening what the downstream Node process can access and making behavior dependent on hidden local state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script directly invokes a production-send mode with no visible warning, dry-run default, or confirmation prompt. In a skill meant to handle reminders and chat routing, that makes accidental real-world delivery to production channels likely, which can leak employee data, spam internal communications, or trigger unintended operational actions.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The natural-language instructions, headings, and operational guidance are presented in Vietnamese only. Under the language/locale policy, forcing a single language without opt-in or justification can be a policy violation.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Natural-language policy requires flagging cases where a skill forces a specific language or locale without user opt-in. This file's operational instructions are entirely in Vietnamese and do not indicate that the skill is region-specific or that users may choose another language.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language instructions are presented almost entirely in Vietnamese, which effectively forces a specific language for operators reading the deployment guide. Under the stated policy, a fixed language is a concern unless the file offers user choice or clearly documents that the skill is intentionally region- or locale-specific.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The manifest describes an internal reminder/reporting workflow around Google Sheets and chat routing, but this launcher script imports all variables from a local .env file before execution. Reading arbitrary local environment configuration is not described in the manifest and introduces a broader capability than the business-purpose description suggests.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/plan-a-demo.js:24

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/plan-a-demo.js:8