Workflowy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:18 AM UTC
• Version: 1.0.7

Overview

This Workflowy skill is coherent, but it should be reviewed because it uses an unofficial unpinned CLI with a long-lived API key that can read, edit, and delete private outline data.

Review the third-party workflowy CLI before installing, consider pinning or verifying the exact release, and treat the Workflowy API key like a password. Prefer the file with restrictive permissions over broad environment exposure, rotate the key if compromise is suspected, and manually confirm delete, move, replace, and transform commands before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Unofficial CLI Handles Sensitive Workflowy Credentials and Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–14 and line 19
Vulnerability Type: Unverified and unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: brew
    formula: mholzen/workflowy/workflowy-cli
    bins: [workflowy]

markdown

Use the unofficial `workflowy` CLI [mholzen/workflowy](https://github.com/mholzen/workflowy) to interact with the [Workflowy API](https://workflowy.com/api-reference/) for managing a Workflowy outline. Requires API key setup.

Technical Analysis

The skill directs users to install an unofficial third-party Workflowy CLI through a mutable Homebrew formula. It does not pin an exact package version, source commit, or cryptographic checksum. Consequently, the dependency installed when the skill is used may differ from the implementation that was originally reviewed.

The CLI receives access to a Workflowy API key through ~/.workflowy/api.key or the WORKFLOWY_API_KEY environment variable. It is also authorized to read and modify private outline data. A compromised upstream repository, Homebrew tap, release artifact, maintainer account, or dependency in the CLI's own supply chain could therefore introduce code that executes under the user's local account and has access to these resources.

This finding does not establish that the named project is malicious. The risk arises from trusting an unofficial, unpinned dependency with sensitive credentials and destructive data-management capabilities without integrity verification.

Attack Path

1. An attacker compromises the CLI repository, release process, Homebrew formula source, maintainer account, or a transitive dependency.
2. The attacker publishes a modified release while retaining the expected package and executable names.
3. A user follows the skill's installation instructions or upgrades the unpinned formula.
4. Homebrew installs the attacker-controll ...[truncated 786 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official Workflowy client or an officially supported integration where available.
2. Pin the CLI to a specific audited release and immutable source commit rather than tracking a mutable formula.
3. Verify release artifacts with a documented cryptographic checksum or signature before installation.
4. Pin and audit transitive dependencies and use automated dependency and provenance scanning.
5. Document the exact repository, release version, expected digest, and verification procedure in the skill.
6. Run the CLI with the least possible local and API privileges, ideally in an isolated environment with access only to required files.
7. Avoid exposing the API key broadly through the process environment when file-based credential handling with restrictive permissions is available.
8. Rotate the Workflowy API key promptly if dependency compromise is suspected, and review the account for unauthorized data access or destructive operations.
9. Require explicit user confirmation before destructive commands such as recursive deletion or broad replacement operations.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s invocation guidance is broad enough to activate on many generic outlining, note-editing, or URL-sharing requests, which can cause the agent to route user tasks into this skill without a narrowly scoped trigger. In context, this increases the chance of unintended access to or modification of a user’s Workflowy data, especially because the skill supports destructive operations like delete, move, replace, and transform.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The skill instructs users to persist a long-lived API key in a predictable path under the home directory or in an environment variable, which creates durable credential exposure if the host is compromised, home directories are backed up insecurely, or process environments are inspectable. In this skill’s context, that credential grants ongoing access to the user’s Workflowy data and enables both reading and modifying their outline.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Get your API key at https://workflowy.com/api-key/, save it to ~/.workflowy/api.key, and ensure only your user can access it:

bash

mkdir -p ~/.workflowy
echo "your-api-key-here" > ~/.workflowy/api.key
chmod 600 ~/.workflowy/api.key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash

mkdir -p ~/.workflowy
echo "your-api-key-here" > ~/.workflowy/api.key
chmod 600 ~/.workflowy/api.key

Alternatively, set the WORKFLOWY_API_KEY environment variable:

Static analysis

No suspicious patterns detected.