workbuddy-checkin

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires reading the local accessToken and using it as the "Authorization: Bearer " value when calling the API, meaning the agent must handle and insert the secret verbatim into requests (exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup scripts can optionally run npm install electron@37 (when WB_CHECKIN_AUTO_INSTALL_ELECTRON is enabled), which fetches Electron from the npm registry (https://registry.npmjs.org) and then executes the downloaded Electron binary to perform token decryption, so the skill can fetch remote code at runtime and execute it (https://registry.npmjs.org).