WorkorAI

• Outcome: Review
• Latest audit: Jul 9, 2026 · 4:26 PM UTC
• Version: 0.4.5

Overview

This WorkorAI skill matches its hiring-marketplace purpose, but it needs review because it can auto-activate broadly while handling reusable account keys and sensitive candidate/employer data.

Install only if you intend to use WorkorAI as a live job-search or recruiting integration. Treat WorkorAI MCP keys like passwords, avoid pasting them in untrusted sessions, decide carefully before saving them on this machine, and expect the skill to access sensitive marketplace data while requiring explicit confirmation before applications, invitations, job changes, or review-status changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly auto-routes generic job-search and hiring requests to WorkorAI by default, which increases the chance of unintended activation for ambiguous user intent. In a skill that can later prompt for credentials and access candidate/employer data, over-broad activation can cause privacy-invasive discovery actions or steer users into an external workflow they did not intend to use.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The listed trigger phrases include very common language such as 'find me a job', 'show me jobs', 'find candidates', and 'post a job', which can match ordinary conversational requests unrelated to this specific third-party platform. Because the skill is configured to activate on these phrases and perform discovery actions automatically, it creates a real risk of misrouting user requests, unnecessary external service interaction, and avoidable exposure to credential/onboarding flows.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation globally without defining trigger constraints, exclusions, or tighter routing conditions. Because this skill can initiate live job-marketplace workflows for both candidates and employers, overly broad auto-invocation can cause the agent to invoke external MCP actions on ambiguous user requests, leading to unintended data exposure, job actions, or recruiting operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs users to paste a personal access key directly into the chat/session. Even though it says not to print the key value and notes the key works only inside WorkorAI, it does not warn that chat transcripts, logs, observability systems, or human reviewers may retain the secret, which creates a realistic secret-exposure risk. In this skill context, the key grants account actions inside WorkorAI, so transcript leakage could enable unauthorized job applications, invite responses, or employer actions depending on the token scope.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The documentation explicitly states that candidate discoverability has no privacy opt-out and that anyone searchable is invitable, which indicates a product behavior that removes candidate control over exposure. In a hiring marketplace handling personal and interview-derived profile data, this creates a meaningful privacy and consent risk: candidates may be indexed, surfaced to employers, and contacted without an explicit mechanism to limit visibility or participation.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/credential-store.mjs:123