Asana

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 1.0.2
• Hash: dc6bbc93db90b6769e58e2bae37967bfbbff7ecc7b7ffabb3619c819da0a90fa
• Source: palm
• External report: View on VirusTotal

Findings (1)

The Asana skill bundle is a standard API integration for managing workspaces, projects, and tasks. It implements a clear authentication flow using either Personal Access Tokens (PAT) or OAuth, storing credentials locally in the user's home directory (~/.openclaw/asana/). The code (asana_api.mjs, oauth_oob.mjs) interacts exclusively with official Asana endpoints (app.asana.com) and lacks any indicators of data exfiltration, malicious execution, or prompt injection.