Security audit

Zapier

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Zapier automation reference, but it needs review because it encourages broad automation, raw data forwarding/logging, and persistent account context without enough safeguards.

Install only if you are comfortable letting the agent help design and potentially operate broad Zapier workflows. Keep API keys in environment or managed secret fields, require explicit confirmation before enabling, deleting, sending messages, or calling arbitrary webhooks, and avoid logging or emailing raw payloads or putting personal data in URLs. Review and prune any ~/zapier/memory.md or main workspace memory entries it creates.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: webhooks.md:259
Finding: Unrestricted Retention and Forwarding of Complete Webhook Payloads
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: interfaces.md:50
Finding: Personal and Customer Information Embedded in Interface URLs
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Note

Location: setup.md:11
Finding: Persistent Storage of User Stack and Activation Preferences
Content: View full analysis
- Google Sheets - Slack - Salesforce - (add as discovered) ## Active Zaps Format: Trigger App → Action App (purpose) ## Common Patterns ## Preferences complexity: simple | advanced notifications: slack | email | both error_handling: alert | silent ``` ### Technical Analysis The Skill instructs the Agent to persist activation behavior in the main workspace memory and retain information about the user's applications, workflows, Zapier subscription, API access, active Zaps, and notification preferences. This creates cross-session state that can influence later Agent behavior and reveals potentially sensitive organizational architecture. Persistence is related to personalization and is disclosed, so it is not evidence of a covert backdoor. Nevertheless, writing activation preferences to general workspace memory exceeds the narrower requirement of keeping Zapier-specific preferences in `~/zapier/memory.md`. The instructions ...[truncated 1743 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (67)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · api.md (reported line 5)May include surrounding context.
Authentication

Get API key from: https://zapier.com/developer/platform

bash
export ZAPIER_API_KEY="your_api_key_here"

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · webhooks.md (reported line 10)May include surrounding context.
md
| **Catch Hook** | Incoming | Receive data from external systems | | **Catch Raw Hook** | Incoming | Receive non-JSON data (XML, CSV) | | **Retrieve Poll** | Incoming (Pull) | Fetch data from URL on schedule | | **POST/PUT/GET** | Outgoing | Send data to external systems | | **Custom Request** | Outgoing | Full control over HTTP request | ## Incoming Webhooks

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The 'When to Use' section says 'Any Zapier operation' followed by a wide list of activities, without defining clearer activation boundaries or exclusions. For a markdown skill description, this is ambiguous enough to invite unintended invocation on broad, everyday Zapier-related requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The communication action examples send email addresses, names, phone numbers, and order information through Gmail, Slack, and Twilio without warning that these are external delivery channels and may expose personal data to unintended recipients. This is risky because users may copy these patterns directly into production workflows without considering privacy, authorization, or recipient validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The webhook examples demonstrate sending personal data such as name, email, and user_id to external endpoints without any guidance about data minimization, user consent, destination trust, or handling of secrets. In an automation skill, this can normalize unsafe exfiltration patterns and lead users to transmit sensitive data to third-party systems without adequate review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This example shows an Authorization bearer token inline in a webhook request pattern, which can encourage insecure secret handling and accidental credential exposure if users copy the example literally into shared documentation or logs. Combined with external transmission, this raises the risk of token leakage and unauthorized API access.
Content: Scanner excerpt · actions.md (reported line 197)May include surrounding context.
POST with Headers

text
Action: Webhooks by Zapier → POST URL: https://api.yourapp.com/webhook Headers: Authorization: Bearer your_api_key Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This custom request example again embeds an Authorization bearer token pattern alongside a user-specific external API call, which can normalize hardcoded secret usage and transmission of account-linked data to external services without review. If copied into real workflows, it can lead to credential leakage or misuse of privileged API access.
Content: Scanner excerpt · actions.md (reported line 209)May include surrounding context.
text
Action: Webhooks by Zapier → Custom Request Method: PATCH URL: https://api.yourapp.com/users/{{trigger.user_id}} Headers: Authorization: Bearer your_api_key Data:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 11)May include surrounding context.
export ZAPIER_API_KEY="your_api_key_here"

Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 12)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 20)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 39)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 45)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 51)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 60)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 69)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 77)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 83)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 89)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 178)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 196)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 211)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · api.md (reported line 218)May include surrounding context.
Test connection

curl -H "Authorization: Bearer $ZAPIER_API_KEY"
https://api.zapier.com/v1/profile

text
## Profile & Account

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: interfaces.md:159

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

SkillSpector

Credential Access

Authentication

Exfiltration Commands

Vague Triggers

Missing User Warnings

Missing User Warnings

External Transmission

POST with Headers

External Transmission

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

External Transmission

Test connection

Static analysis

Prompt-injection style instruction pattern detected.