WorkbuddyOs

• Outcome: Review
• Latest audit: Jul 31, 2026 · 4:01 AM UTC
• Version: 1.6.0

Overview

This skill is a WorkBuddy visual skin tool, but it includes persistent auto-start and app-launch modifications that are broader than the main skill instructions disclose.

Install only if you intentionally want WorkBuddy run with a local debugging port and, in automatic mode, a persistent background LaunchAgent. Avoid the auto-install scripts unless you are comfortable modifying the WorkBuddy app launcher and know how to run both uninstall scripts to reverse it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The script does more than a one-time install: it creates a LaunchAgent with RunAtLoad and KeepAlive, causing a watcher to persist across logins and continuously run. For an agent skill that mentions auto-start and automatic injection behavior, understated disclosure increases risk because users may not understand they are installing a persistent background component.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script connects to a local Chrome DevTools debugging endpoint on 127.0.0.1:9223, locates a renderer page, and issues a remote Page.reload command over the debugger WebSocket. The comment frames this as harmless restoration of the official appearance, but using the DevTools protocol to manipulate a renderer is a privileged control path that can be used to interfere with or conceal prior UI injection or tampering, making the misleading description itself suspicious.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This script is a thin Chrome DevTools Protocol client that takes attacker-controlled input from the command line or a file and forwards it directly to Runtime.evaluate in the WorkBuddy renderer. That enables arbitrary JavaScript execution inside the renderer context, which can expose application state, tokens, DOM data, and privileged APIs available to that page; the lack of any stated restriction or narrow purpose makes the capability especially risky in skill context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to install a startup hook that alters the Electron app launch path and to register a persistent LaunchAgent watcher that continuously monitors for the app process and auto-injects code. Even if presented as a customization feature, these are system-level persistence and process-manipulation behaviors that materially increase attack surface and can normalize unsafe installation patterns, especially because the tooling also exposes a remote debugging port and arbitrary JS injection capability.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill instructs the agent to restart WorkBuddy in debug mode and inject a skin, which changes runtime behavior of the application, but the warning is minimal and not prominently framed as a potentially disruptive action. In an automation context, insufficient up-front disclosure can cause unintended interruption of user work or modification of app state without informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script silently writes a plist into ~/Library/LaunchAgents and immediately loads it with launchctl, establishing persistence without prior warning or consent at runtime. Even though this is in user space, unattended persistence is risky because it changes execution behavior on every login and can be abused to keep modification logic always active.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script renames the app’s original Electron binary and replaces it with a wrapper that always enables a Chrome DevTools Protocol remote debugging port. This is a persistent, invasive modification to the installed application and materially weakens runtime security by exposing a debugging interface that may permit inspection or control of the app, especially if the port is reachable by other local processes or network-exposed through other tooling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script runs indefinitely as a LaunchAgent, probes a local debugging endpoint, and automatically executes another program when a matching renderer is detected, all without any visible user consent or runtime disclosure in the script. That behavior creates persistence and automated code execution tied to another app's lifecycle, which increases abuse potential if the target script or local debug interface is compromised or repurposed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This background watcher continuously probes a local HTTP service on 127.0.0.1:9223 and, when a matching renderer is detected, automatically launches another script without any user consent, validation, or visible disclosure. That creates stealthy persistence and implicit trust in a local debugging endpoint, which can be abused if another local process binds that port or if the invoked apply script performs privileged or security-relevant modification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script force-quits and relaunches WorkBuddy with a remote debugging port enabled, without prompting the user or obtaining consent. This can disrupt active work, cause data loss if the app has unsaved state, and weakens the app's security posture by enabling a DevTools/CDP endpoint that is then used to inject arbitrary JavaScript into the renderer.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool executes arbitrary JavaScript in the renderer immediately based on user-supplied input, with no warning, confirmation, or indication that it is attaching to a live debugger and running code in application context. In a skill environment this increases the chance of accidental misuse and makes social engineering or hidden invocation paths more dangerous.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This script connects to a local Chrome DevTools endpoint, selects a renderer page, and uses Runtime.evaluate over WebSocket to execute dynamically constructed JavaScript in that page context. Even though it appears intended for local hot-reloading of CSS during development, this creates a powerful code-injection path into any matching local debug target and relies on an unauthenticated local debugging service, which can be dangerous if exposed, misconfigured, or run against the wrong target.

Session Persistence

Medium

• Category: Rogue Agent

Content

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
LABEL="com.workbuddy.skin"
PLIST="$HOME/Library/LaunchAgents/${LABEL}.plist"

# 找 node（launchd 环境没有用户 PATH，必须绝对路径）
NODE="$(command -v node || true)"

• Confidence: 95% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
LABEL="com.workbuddy.skin"
PLIST="$HOME/Library/LaunchAgents/${LABEL}.plist"

# 找 node（launchd 环境没有用户 PATH，必须绝对路径）
NODE="$(command -v node || true)"

• Confidence: 95% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

chmod +x "$ROOT/scripts/watch.local.sh"

# 生成并加载 LaunchAgent
cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 97% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

# 生成并加载 LaunchAgent
cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>${LABEL}</string>

• Confidence: 97% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

# 生成并加载 LaunchAgent
cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>${LABEL}</string>

• Confidence: 97% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>${LABEL}</string>
  <key>ProgramArguments</key>

• Confidence: 98% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

<key>StandardOutPath</key><string>$ROOT/scripts/watch.log</string>
  <key>StandardErrorPath</key><string>$ROOT/scripts/watch.log</string>
</dict>
</plist>
EOF

launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true

• Confidence: 88% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF

launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
launchctl bootstrap "gui/$(id -u)" "$PLIST"
echo "✓ 自动换肤已开启：今后正常打开 WorkBuddy 即可，皮肤会自动生效"
echo "· 日志：$ROOT/scripts/watch.log；卸载：scripts/uninstall-auto.sh"

• Confidence: 99% confidence
• Finding: PLIST

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/apply.mjs:21