workorai
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill uses a dedicated Node.js script (
scripts/credential-store.mjs) to manage WorkorAI API keys securely. It prioritizes system-level secret storage such as macOS Keychain, Linux Secret Service, and Windows SecretManagement over local file storage. - [SAFE]: For local file storage of credentials, the skill enforces strict file permissions (0600) and uses a shared configuration directory (~/.config/workorai/), which is a standard and secure practice for CLI-based tooling.
- [SAFE]: The instructions and the management script include explicit logic to redact WorkorAI API keys (following the
wai_...pattern) in any output visible to the user, preventing accidental credential exposure in chat transcripts. - [COMMAND_EXECUTION]: The provided management script invokes local system binaries like
security,secret-tool, andpowershellto perform credential operations. These calls are implemented usingexecFileSyncandspawnSyncwith validated parameters, mitigating the risk of command injection.
Audit Metadata