Employee Reminder Ops

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.1

Overview

The skill matches its stated reminder workflow, but it includes live-looking default Google Sheet, Google account, and Discord channel settings that could move employee data to the wrong place if used without careful review.

Review before installing or running live sends. Set your own PLAN_A_SHEET_ID, GOG_ACCOUNT, DISCORD_CHANNEL_ID, and DISCORD_BOT_TOKEN; run preview/json first; use a test channel and non-production data before prod-send or any scheduler; disable PLAN_A_INCLUDE_INVALID_DETAILS unless needed; and confirm that your organization is comfortable sending employee birthday, department, and event data to the chosen chat service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes capabilities that require network access and likely environment-based secret/config usage, but it declares no corresponding permissions or trust boundary. This creates a transparency and policy-enforcement gap: an operator may install or approve the skill without understanding that it can access external services and sensitive runtime configuration such as bot tokens and spreadsheet credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly routes employee and event data from Google Sheets into Telegram or Discord chats but does not warn users that internal personnel data may be transmitted to third-party messaging platforms. In this context, that omission is security-relevant because birthday, department, role, and event information can expose personal or internal operational data to broader chat audiences or external vendors if routing is misconfigured.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation includes commands that send messages to a real Discord channel using a live bot token, but the warning is relatively weak and easy to miss in operational usage. In an internal ops skill that automates reminders and reports, this increases the chance of accidental posting to external chat infrastructure, potentially leaking employee-related scheduling or event information and causing unintended notifications.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The deployment guide instructs operators to send messages to chat destinations but does not clearly require a non-production test channel or warn that staff/event data may be disclosed to unintended recipients. In this skill's context, reminders and special-event reports likely contain employee-related information, so a misconfigured Telegram/Discord destination can leak internal data to real teams or external chats.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The checklist tells users to perform manual sends and then enable a 7:00 AM scheduler without any guardrails for production impact. That creates a realistic risk of accidental broadcasts, repeated notifications, or disclosure of employee/event information to real recipients if configuration is wrong or testing is done against live data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits employee birthdays, department information, event ownership, and optionally invalid-row details to a third-party chat service (Discord) in the send/sendProductionReport paths without an interactive confirmation, recipient validation step, or data-minimization gate. In an internal operations context this is plausibly intentional, but it still creates a real confidentiality risk if the channel ID is misconfigured, the bot is present in an overly broad server, or invalid-detail mode exposes extra staff metadata.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/plan-a-demo.js:24

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/plan-a-demo.js:8