workbuddy-theme
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The utility scripts (workbuddy-theme.mjs, switch-theme.mjs) use Node.js child_process modules to interact with the macOS environment. This includes using osascript to gracefully quit the target application, open to relaunch it with specific debugging flags, and plutil to inspect the application's version info.
- [COMMAND_EXECUTION]: The skill implements a background 'guard' process using spawn with the detached flag. This process monitors the WorkBuddy renderer and ensures the theme remains applied if the application reloads, effectively acting as a session-based background service.
- [SAFE]: The skill demonstrates strong security posture by including a comprehensive validation script (validate-theme.mjs). This script prevents common CSS-based attacks by blocking the @import rule and restricting url() values to local assets, preventing external data exfiltration or remote style loading.
- [SAFE]: The mechanism for injecting themes—enabling the Chrome DevTools Protocol (CDP)—is handled transparently. The skill documentation and implementation require explicit user permission before relaunching the application with the --remote-debugging-port flag, and the port is correctly restricted to the local loopback interface (127.0.0.1).
Audit Metadata