Security audit
Security checks for vulnerabilities and agentic risk
This WorkBuddy automation appears purpose-aligned, but it uses local login tokens, external helper code, desktop control, and Windows scheduled tasks in ways users should review carefully before installing.
Install only if you are comfortable letting this skill read or decrypt your local WorkBuddy login state, send the bearer token to official service endpoints, control your mouse on Windows, write local screenshots/state files, and briefly create a Windows scheduled task during update recovery. Review or avoid the optional external helper skills before using the API decrypt or PowerShell screenshot paths.
该代码块的主功能与声明只部分一致：它确实会读取本机登录态并直连官方接口完成 Buddy 加油站签到，也兼容加密登录态（通过外部解密引擎）。但声明描述的是一个更大的技能，包含两大方向：1) API 直连 + GUI 坐标点击双方案；2) ‘派猫猫旅行’相关只读与自动化领取/派出。当前代码仅覆盖其中一部分——Buddy 加油站 API 签到。没有看到任何 ctypes 窗口操作、鼠标点击、截图灰度校验，也没有任何与猫猫旅行有关的接口、状态、积分、派出或 --auto 参数处理。因此描述明显高于该代码实际行为，属于描述与实现不符。另一方面，代码读取本地登录态并调用远程官方接口，这些行为已被声明中的 API 直连方案覆盖，不构成额外未声明的越权能力。
该代码与声明存在明显描述-行为不一致。代码完整实现的是 WorkBuddy “Buddy 加油站” 的 GUI 坐标点击签到方案，包括窗口枚举、DPI 处理、鼠标控制、截图分析、按钮状态校验、校准流程，以及遇到客户端更新时通过截图识别更新横幅并借助 Windows 计划任务进行续签。这与声明中的“GUI 坐标点击方案兜底”部分基本一致。 但声明还把“API 直连方案（推荐）”作为重要能力，具体包括读取本机登录态、直调官方接口、兼容加密登录态并自动做 AES-256-GCM 信封解密；代码中完全没有网络请求、接口调用、cookie/token/session 读取、加密解封装等实现。此外，声明中提到支持“派猫猫旅行”的只读状态展示、先领后派自动化闭环以及显式 --auto 控制写操作，而本代码完全没有任何与该功能相关的参数、页面识别、业务流程或数据处理。 因此，这不是轻微遗漏，而是声明覆盖了多个未实现的核心能力；实际代码的主要能力仅是 Windows 上的 GUI 签到脚本。应判定为不匹配。
The skill describes reading and decrypting local authentication state, including newer encrypted token formats, but does not present a clear up-front warning that it will access highly sensitive credentials. In context, the missing warning is dangerous because the skill is framed as a generic shareable utility while quietly handling bearer tokens that could grant authenticated API access.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
ps = _find_desktop_control_ps1()
if ps:
try:
env = dict(os.environ)
env.pop("ACC_PRODUCT_CONFIG_V3", None) # 防超大环境块撑爆 PowerShell Add-Type
r = subprocess.run(
["powershell.exe", "-ExecutionPolicy", "Bypass", "-File", ps,
The README is entirely written in Chinese and all user-facing invocation examples and operational guidance assume Chinese-language use, with no indication that other languages are supported or that the user can choose a locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill documents capabilities to read local files and environment data, write files, make network requests, and invoke shell/scheduled-task operations, yet it declares no explicit tool scope or permission boundaries. In an agent ecosystem this creates overbroad ambient authority, making it easier for the skill to access sensitive local authentication material and perform system changes without clear user review.
The '何时使用' section lists activation phrases such as '自动签到' and also suggests running on a daily schedule, but it does not clearly constrain the trigger to WorkBuddy-specific contexts or provide exclusion examples. '自动签到' is generic enough to collide with other check-in or automation tasks, increasing the chance of unintended invocation.
The documentation explicitly describes extracting secrets from local login state and, when needed, using process-memory scanning or CDP-based techniques to recover keys/tokens. Those behaviors materially exceed a normal check-in workflow and introduce credential-access functionality that could expose bearer tokens for account takeover or reuse against other official endpoints.
The documented creation and deletion of Windows scheduled tasks expands the skill from a simple check-in helper into persistent system automation. Persistence mechanisms can surprise users, survive application restarts, and be repurposed to run arbitrary commands later, increasing the blast radius if the skill is modified or misused.
The privacy comment is materially misleading: the script reads a local bearer token and transmits it to remote Tencent/CodeBuddy endpoints in the Authorization header. Even if this is required for the feature, claiming credentials are 'not exfiltrated' can cause users or reviewers to underestimate the sensitivity of the operation and grant trust they would not otherwise give.
The code explicitly adds deferred self-reexecution by creating and deleting Windows scheduled tasks, which exceeds the narrow purpose of a simple daily check-in helper. Any mechanism that persists execution outside the current session raises the risk profile because it survives process restarts and resembles persistence behavior.
This section invokes both PowerShell and schtasks, introducing system-level command execution capabilities unrelated to simple GUI clicking. In the context of an automation skill, this broadens the attack surface substantially because external scripts and OS task scheduler state become part of the trust boundary.
The script launches PowerShell with ExecutionPolicy Bypass to run another local skill script discovered from the user's home directory. This expands trust to an external file outside this script, so if that PowerShell file or skill directory is tampered with, the check-in flow becomes an arbitrary code execution path.
try:
env = dict(os.environ)
env.pop("ACC_PRODUCT_CONFIG_V3", None) # 防超大环境块撑爆 PowerShell Add-Type
r = subprocess.run(
["powershell.exe", "-ExecutionPolicy", "Bypass", "-File", ps,
"-Action", "screenshot", "-Target", TARGET_TITLE, "-OutputPath", out_path],
capture_output=True, text=True, encoding="utf-8", errors="replace",
The script creates a Windows scheduled task via schtasks to re-run itself later, which is a persistence-like capability outside the core mouse-click check-in flow. Although arguments are hardcoded and there is no obvious command injection here, registering autonomous re-execution increases system-level impact and could be abused if the script or its path is modified.
py = sys.executable
script = os.path.abspath(__file__)
st = time.strftime("%H:%M", time.localtime(time.time() + RESUME_DELAY_SEC))
r = subprocess.run(
["schtasks", "/create", "/tn", RESUME_TASK_NAME,
"/tr", f'"{py}" "{script}" -resume',
"/sc", "once", "/st", st, "/f"],
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def cancel_resume_task():
"""删除续签计划任务(续签完成/不需要时清理, 防止残留)。"""
try:
subprocess.run(["schtasks", "/delete", "/tn", RESUME_TASK_NAME, "/f"],
capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=30)
print(f"== 已删除续签计划任务 [{RESUME_TASK_NAME}]")
except Exception:
Running with -run immediately takes over the mouse and performs clicks after only printing warnings, without an explicit final confirmation or countdown consent step. In a desktop automation context this can cause unintended actions on the user's machine, especially since the script manipulates focus, cursor position, and clicks in the active desktop session.
The request headers hard-code "Accept-Language": "zh", which imposes a specific language/locale behavior in all API calls. This is a natural-language policy concern because the script does not offer user opt-in or explain a required region-specific constraint for forcing Chinese.
The file’s user-facing comments and usage instructions are entirely in Chinese, and later runtime prompts and status messages also assume Chinese-speaking users. For a general-purpose automation script, this is a natural-language locale constraint without user opt-in or a documented justification that the skill is China-specific only.
No suspicious patterns detected.