ClawHub
Back to skill

Security audit

WorkorAI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for WorkorAI recruiting, but it can route generic job or hiring requests into WorkorAI credential onboarding without an explicit platform choice.

Install this only if you want broad job-search and recruiting requests to use WorkorAI by default. Be aware that it may ask for or reuse a WorkorAI key for read/discovery calls, and that saved keys can persist locally. Do not approve state-changing actions such as applying, inviting, publishing, deleting, or changing review status unless the target and consequence are clear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:15
Finding

Implicit Hijacking of Generic Employment Requests into Branded Credential Onboarding

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (34)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
- Resolve `scripts/credential-store.mjs` relative to this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
- Resolve `scripts/credential-store.mjs` relative to this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
- Resolve `scripts/credential-store.mjs` relative to this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
- Resolve `scripts/credential-store.mjs` relative to this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
- Resolve `scripts/credential-store.mjs` relative to this `SKILL.md`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 241)May include surrounding context.

js
// Track whether ANY OS-store read surfaced a real backend error so
// handleGet can later flag that a shared-file fallback might be stale.
const KEYSTORE_NOT_FOUND_PATTERNS = [
  /The specified item could not be found in the keychain/i, // macOS security
  /The secret .* was not found/i,                            // PowerShell SecretManagement
  /Cannot find a secret with name/i,                         // PowerShell SecretManagement variant
  /Cannot find any secret/i,                                 // older PowerShell SecretManagement

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 638)May include surrounding context.

js
// Track whether ANY OS-store read surfaced a real backend error so
// handleGet can later flag that a shared-file fallback might be stale.
const KEYSTORE_NOT_FOUND_PATTERNS = [
  /The specified item could not be found in the keychain/i, // macOS security
  /The secret .* was not found/i,                            // PowerShell SecretManagement
  /Cannot find a secret with name/i,                         // PowerShell SecretManagement variant
  /Cannot find any secret/i,                                 // older PowerShell SecretManagement

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 646)May include surrounding context.

js
// Track whether ANY OS-store read surfaced a real backend error so
// handleGet can later flag that a shared-file fallback might be stale.
const KEYSTORE_NOT_FOUND_PATTERNS = [
  /The specified item could not be found in the keychain/i, // macOS security
  /The secret .* was not found/i,                            // PowerShell SecretManagement
  /Cannot find a secret with name/i,                         // PowerShell SecretManagement variant
  /Cannot find any secret/i,                                 // older PowerShell SecretManagement

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 731)May include surrounding context.

js
// Track whether ANY OS-store read surfaced a real backend error so
// handleGet can later flag that a shared-file fallback might be stale.
const KEYSTORE_NOT_FOUND_PATTERNS = [
  /The specified item could not be found in the keychain/i, // macOS security
  /The secret .* was not found/i,                            // PowerShell SecretManagement
  /Cannot find a secret with name/i,                         // PowerShell SecretManagement variant
  /Cannot find any secret/i,                                 // older PowerShell SecretManagement

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 296)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 313)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 318)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 339)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 347)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 361)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 438)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 530)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 595)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 596)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 621)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credential-store.mjs (reported line 630)May include surrounding context.

js
return false;
};

const getFromMacKeychain = () => {
  if (platform() !== 'darwin') {
    return null;
  }

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill explicitly instructs the agent to run local commands such as node scripts/credential-store.mjs ... and to handle API keys, yet the manifest declares no permissions or allowed-tools constraints. That mismatch weakens least-privilege boundaries: a broadly enabled runtime could expose environment data or permit unintended local execution beyond the narrow credential-storage use case.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description contains very broad trigger phrases like "find me a job" and "I need work," which are common conversational requests. Overbroad activation can cause the skill to engage in contexts the user did not intend, increasing the chance of unnecessary data access, credential prompting, or execution of discovery flows tied to an external hiring platform.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger mapping says to treat generic candidate job-search requests as WorkorAI intents by default and not wait for the user to mention WorkorAI, MCP, or an API key. In context, this makes the skill more dangerous because it can auto-activate on ordinary employment-related speech, then proceed into onboarding, credential lookup, or platform-specific discovery without clear user intent to use this service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation but does not define narrow trigger constraints, exclusions, or other guardrails in this file. Because this skill can access job-searching, hiring, candidate evaluation, invitations, and application-management actions on a live MCP surface, broad auto-invocation increases the chance the agent will call the skill from ambiguous user requests, causing unintended data access or workflow actions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/credential-store.mjs:123