Zendesk

PassAudited by VirusTotal on May 6, 2026.

Overview

Type: OpenClaw Skill Name: zendesk-support Version: 0.1.0 The skill bundle provides instructions for an AI agent to manage Zendesk workflows using the ClawLink integration hub. It follows standard OAuth pairing and dynamic tool discovery patterns, includes explicit safety rules to prevent credential leakage, and requires user confirmation for destructive actions. No evidence of malicious intent, data exfiltration, or unauthorized execution was found in SKILL.md or _meta.json.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Connecting Zendesk can let the agent view or act on support tickets and users within the granted Zendesk permissions.

Why it was flagged

The skill requires delegated Zendesk account access through OAuth, which is expected for a Zendesk integration but gives the agent access according to the user's Zendesk permissions and scopes.

Skill content
ClawLink's hosted page runs the hosted OAuth flow — the user clicks through the Zendesk login and authorization screen.
Recommendation

Review the Zendesk authorization screen and use the least-privileged Zendesk account or scopes available.

What this means

If approved, the agent may change Zendesk tickets or workflows, including actions that could be customer-facing.

Why it was flagged

The skill can execute Zendesk write actions through ClawLink, but it also documents preview and user-confirmation steps before risky operations.

Skill content
For writes or anything marked as requiring confirmation, call `clawlink_preview_tool` first, then confirm with the user.
Recommendation

Check previews carefully before approving writes, especially destructive, external-facing, or bulk actions.

What this means

The separate plugin will provide the actual ClawLink tools used to connect to Zendesk.

Why it was flagged

The skill is instruction-only but relies on installing a separate plugin from ClawHub; this is central to its purpose, but that plugin's code is outside the provided artifact set.

Skill content
Install the verified ClawLink plugin: `openclaw plugins install clawhub:clawlink-plugin`
Recommendation

Install only the intended ClawLink plugin and verify its publisher/source before connecting Zendesk.

What this means

Zendesk requests, responses, and credential-mediated actions may be processed through ClawLink.

Why it was flagged

The agent depends on a hosted integration hub and dynamic tool catalog, so Zendesk operations and related data are mediated through ClawLink rather than being fully local.

Skill content
ClawLink provides tools dynamically based on what the user has connected. You do not need to know tool names or schemas in advance.
Recommendation

Use ClawLink only if you trust that service with the relevant Zendesk support data, and disconnect the integration when no longer needed.