Claude security directory

Windmill HR

Published by Windmill

High risk

Windmill is the AI-powered performance review platform for People Ops teams, and this connector brings your whole review workflow into Claude. Instead of clicking through dashboards, just ask. Key features: • Performance reviews: Track review cycles, see who's done and who still needs a nudge, and pull full context (feedback, AI recaps, 1:1 notes) when drafting a review. • Feedback: Give feedback and shoutouts, request feedback about anyone on your team, and query everything that's been shared. • 1:1s: Create recurring 1:1s, prep and update shared agendas, and check upcoming meetings. • Pulse surveys: Create and schedule pulses, send them instantly, nudge non-responders, and analyze results. • People data: Query and update employees, manage groups, and invite workspace members. • AI recaps: Pull weekly AI-generated summaries of each employee's work, surfaced automatically from connected work tools. • Private notes: Keep running notes about colleagues that only you can see — ready when review season arrives. • Workforce insights: Query aggregated stats and surface each person's top collaborators through organizational network analysis. All access respects your Windmill role and permissions. Try asking: "Who hasn't finished their reviews in the Q3 cycle?" — "Send the engagement pulse to the engineering team now" — "What did Marcus ship last week?" — "Summarize the feedback Sarah received this quarter."

Security assessment

Plutonium assessed this web connector for permissions, capabilities, and security-relevant behavior.

  • Can permanently delete data: This connector can erase records, files, or accounts. Once deleted the data may be unrecoverable - even an accidental request can cause permanent loss.
  • Can send messages as you: This connector can post messages, emails, or chat replies on your behalf. Recipients will believe the message came from you, which makes phishing or social-engineering risks higher.
  • Can change or update your information: This connector can edit, rename, overwrite, or otherwise modify records in the connected service. If a request gets manipulated, your data could be altered without you noticing.
  • Reads your private information: This connector can read data the connected service holds about you - documents, messages, contact lists, source code, customer records, or saved profile details - and pass it back to the AI.
  • Sends your data to outside companies: Anything you share with this connector flows through one or more third-party services. Those companies see, store, and may use the data according to their own policies.

Available capabilities

This add-on exposes 64 tools or capabilities.

  • employees_count
  • employees_groups_load
  • employees_query
  • employees_update
  • feedback_create
  • feedback_delete
  • feedback_edit
  • feedback_load_visibility_setting
  • feedback_query
  • feedback_requests_cancel
  • feedback_requests_create
  • feedback_requests_query
  • feedback_shoutouts_load_config
  • help_center_page_load
  • help_center_search
  • load_resources
  • members_count
  • members_invite
  • members_query
  • ona_collaborators_top_query
  • one-on-one-events_next
  • one-on-one-events_query
  • one-on-ones_calendar_query
  • one-on-ones_create

The interactive security report will load automatically.