workbuddy-checkin
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts (
checkin.sh,setup.sh) and PowerShell scripts (checkin.ps1,setup.ps1) to execute Node.js and Electron processes. These scripts manage the lifecycle of the check-in process and handle environment detection. - [EXTERNAL_DOWNLOADS]: The setup scripts include functionality to download the Electron runtime from the official npm registry. This feature is disabled by default and requires the user to explicitly set the
WB_CHECKIN_AUTO_INSTALL_ELECTRONenvironment variable, ensuring the user maintains control over external dependencies. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local application data files containing authentication tokens (e.g.,
workbuddy-desktop.infoandstate.vscdb). It transmits these tokens tocopilot.tencent.com, which is the official API endpoint for the WorkBuddy service. The skill includes extensive documentation and terminal warnings informing the user that these tokens are sensitive credentials. - [DYNAMIC_EXECUTION]: The
decrypt-token.jsscript can optionally callpython3to read SQLite database files if the environment's Node.js version lacks native SQLite support. This fallback is guarded by a specific environment variable (WB_CHECKIN_ALLOW_PY_FALLBACK), providing a transparent and restricted execution path.
Audit Metadata