The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads sensitive authentication tokens (accessToken) directly from local application files (workbuddy-desktop.info and state.vscdb). While these are transmitted to the official copilot.tencent.com API, the ability to extract and process raw session tokens is a high-sensitivity operation.
[EXTERNAL_DOWNLOADS]: The setup scripts (setup.sh, setup.ps1) can download the Electron runtime from the official npm registry if the user enables the WB_CHECKIN_AUTO_INSTALL_ELECTRON option. This is documented and uses well-known services.
[COMMAND_EXECUTION]: The scripts spawn several subprocesses to perform their tasks, including calling node, curl, and electron binaries.
[DYNAMIC_EXECUTION]: The decrypt-token.js script may execute Python code via a subprocess (python3 -c ...) to read the local SQLite database if the native node:sqlite module is unavailable. This is an optional fallback mechanism controlled by the WB_CHECKIN_ALLOW_PY_FALLBACK environment variable.
[PERSISTENCE]: The documentation provides instructions for users to manually configure persistence via system tools like crontab (Linux/macOS), schtasks (Windows), and launchd (macOS). The skill itself does not automate the installation of these persistence mechanisms.

workbuddy-checkin