WorkOS

Manage enterprise SSO, Directory Sync (SCIM), Admin Portal, and user management via WorkOS API. Use when asked to set up SSO for an organization, provision u...

What to consider before installing: - The SKILL.md needs a WORKOS_API_KEY (and shows a WORKOS_CLIENT_ID), but the skill metadata doesn't declare these — ask the publisher to update the manifest to list required env vars and the primary credential. - Only provide a least-privilege WorkOS API key scoped to the operations you want (prefer a read-only key if you only need listings). Avoid giving full-admin keys unless necessary. - Because this is an instruction-only skill, it will make outbound API calls using whichever WORKOS_API_KEY is available to the agent; monitor WorkOS audit logs for unexpected activity and rotate keys if you see misuse. - Verify the skill source/owner before trusting it: there is no homepage and the owner ID is opaque. If you can't verify provenance, prefer testing in a non-production environment with test credentials. - Recommend the publisher declare WORKOS_API_KEY (and WORKOS_CLIENT_ID if required) in the registry and indicate the minimal scopes required; that resolves the primary incoherence observed here.

Type: OpenClaw Skill Name: workos Version: 1.0.0 The 'workos' skill is a legitimate integration for managing enterprise SSO and user directories via the WorkOS API. It uses standard curl commands directed at the official 'api.workos.com' endpoint and requires a standard environment variable (WORKOS_API_KEY) for authentication. No evidence of data exfiltration, malicious execution, or prompt injection was found.