ClawHub
Back to skill

Security audit

Zrise Connect Release

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Zrise automation purpose, but it exposes high-impact task automation with weak network, credential, and permission safeguards.

Install only in a controlled environment with a least-privileged Zrise account. Before use, require WORKFLOW_UI_TOKEN, bind the UI to 127.0.0.1, remove Claude permission bypass, restore TLS certificate verification, avoid installing executables from /tmp or mutable latest dependencies, and test against non-production Zrise tasks first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/workflow_manager_ui.py:212
Finding

Fail-Open Management API Exposed on All Network Interfaces

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zrise_utils.py:17
Finding

Zrise Credentials Transmitted Without TLS Certificate Verification

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/execute_task.py:69
Finding

Indirect Prompt Injection Through Zrise Task Content

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/run_workflow_pipeline.py:174
Finding

Claude Workflow Execution Explicitly Bypasses Permission Controls

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/workflow_manager_ui.py:757
Finding

Missing Task-Level Authorization for Direct Object Operations

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/workflow_manager_ui.py:182
Finding

Automatic Removal of macOS Quarantine and Provenance Metadata

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:78
Finding

Unpinned Remote Dependency Installation and Execution from a Predictable Temporary Directory

Content
View full analysis
=3.8", "openclaw": ">=2026.3.0", "lobster": "latest" }, "optional_dependencies": { "pyyaml": ">=6.0" } ``` ### Technical Analysis The documented installation clones the current default branch without pinning a reviewed commit, then executes `npm install` and `npx tsc`. This allows the installed code and transitive dependencies to change after the Skill has been audited. The resulting executable is symlinked from `/tmp/lobster`, a predictable temporary path. Temporary directories are not appropriate permanent executable locations and may be cleaned, replaced, or manipulated by another local actor under permissive system configurations. The repository belongs to the declared OpenClaw organization, so this finding does not establish typosquatting or intentional malware. The risk arises from mutable sources, executable installation hooks, and insufficient integrity controls. ### Attack Path 1. The upstream repository or one of its npm dependencies is compromised, or its mutable default branch changes unexpectedly. 2. The operator follows the installation command after the audit. 3. `npm install` executes the changed dependency graph and any applicable lifecycle scripts. 4. Alternatively, a local attacker targets the predictable `/tmp/lobster` path before a later invocation. 5. `~/bin/lobster` resolves to the modified temporary executable. 6. Workflow commands execute the changed c ...[truncated 410 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (90)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The webhook reply handler performs sensitive actions like approve_task() and reject_task() based solely on message text and chat context, without calling verify_employee() or enforcing authorization. Any Telegram user or spoofed webhook payload that reaches this handler could trigger workflow approvals or rejections, causing unauthorized business actions.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/execute_task.py (reported line 111)May include surrounding context.

python
- files_changed: list of files (if any)
"""
    
    return prompt


def call_agent(task_id, prompt, session_id, agent_id='zrise'):

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow runner invokes claude with --permission-mode bypassPermissions, while the prompt is built from work item data, prior outputs, and workflow configuration that should all be treated as potentially untrusted. That creates a dangerous privilege boundary failure: prompt-injected instructions could cause the agent to perform local or external actions without normal approval safeguards.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
88% confidence
Finding

The code clones the full parent environment into the workflow subprocess (env = {**os.environ}), which can expose secrets such as API tokens, credentials, and internal configuration to any executed workflow or child script. In this skill context, the subprocess target is a workflow pipeline that may process untrusted task/workflow content, so broad environment inheritance increases secret exposure risk.

Content

Scanner excerpt · scripts/workflow_manager_ui.py (reported line 952)May include surrounding context.

python
item_file.write_text(json.dumps(item, indent=2, ensure_ascii=False), encoding='utf-8')

            try:
                env = {**os.environ}
                env['PYTHONPATH'] = str(SCRIPTS_DIR)
                env['PATH'] = '/opt/homebrew/bin:' + env.get('PATH', '')
                env['ZRISE_JSON_OUTPUT'] = '1'

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

TLS verification is explicitly disabled by setting check_hostname to False and verify_mode to CERT_NONE, so the XML-RPC client will trust any certificate. This enables man-in-the-middle interception or modification of traffic, including theft of Zrise credentials and tampering with authenticated RPC requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description states it can post HTML comments, update task stages, and save conversation history in Zrise, which are actions that can affect user data and remote system state. The README presents these capabilities as features and usage examples but does not include any caution, confirmation expectation, or warning about making persistent changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The configuration section instructs users to provide ZRISE_API_KEY and GEMINI_API_KEY and describes AI agents processing tasks, but it does not warn that task content and related system data may be transmitted to external services. For a markdown skill description, omission of privacy and credential-handling warnings is a missing user warning under the rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructions and examples are written entirely in Vietnamese, including operational guidance and sample user messages, with no indication that users may choose another language. This can violate a language/locale policy when a specific language is imposed without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The setup instructions execute tooling via an unpinned package invocation (npx tsc) after cloning a repository from the internet into /tmp. Unpinned transient tool execution weakens supply-chain integrity because different compiler/package versions could be fetched or resolved over time, enabling unexpected or malicious code execution during installation/build.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Line L005 presents core skill behavior documentation in Vietnamese while the rest of the document is in English, with no indication that the locale is optional or region-specific. This creates a language/locale policy concern because users are implicitly forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The documented approval flow allows certain agents to be auto-approved while require_user_selection is set to false, enabling autonomous execution without explicit human confirmation. In an agent-routing system, this reduces oversight and can permit unsafe, unintended, or policy-violating actions to proceed automatically if routing is incorrect or an agent is over-privileged.

Content

Scanner excerpt · docs/AGENT_ROUTING.md (reported line 265)May include surrounding context.

json
"approval_flow": {
  "auto_approve_agents": ["demo-be", "demo-fe"],
  "manual_approve_agents": ["demo-architect"],
  "require_user_selection": false
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file documents a flow where pressing a UI trigger spawns an agent process, executes work, writes results back to Zrise, and updates the task stage to Done. The description presents these actions as normal workflow steps but does not include any caution about subprocess execution, external system writeback, or automatic state changes that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly describes an agent that will generate code, write to files, and write back results automatically, but it does not warn operators that these actions mutate local and remote system state. In an agent skill context, undocumented autonomous write behavior can lead to unintended code changes, accidental data corruption, or unauthorized updates if users assume the workflow is informational or review-gated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/SIMPLE_WORKFLOW_GUIDE.md (reported line 146)May include surrounding context.

  1. Tự xử lý:
    • Fetch task details
    • Generate code
    • Write to file
  2. Writeback to Zrise
text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section encourages use of a workflow where the agent autonomously decides, spawns subagents, and performs writeback without highlighting that these actions can trigger side effects beyond the original user expectation. Autonomous delegation plus state-changing operations increases the risk of uncontrolled execution, expanded permissions use, and unexpected modifications across multiple components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guide tells users how to post content back to Zrise but does not clearly warn that the action publishes data to an external tasking system where others may see or retain it. In a workflow that processes AI-generated output and task data, this increases the risk of accidental disclosure of sensitive, incorrect, or unreviewed information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 39)May include surrounding context.

⚙️ Setup

1. Create Telegram Bot

bash
# 1. Open Telegram, search @BotFather

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation encourages storing bot tokens and sending employee/task data to Telegram, a third-party platform, but does not prominently warn about privacy, data handling, retention, or compliance implications. The token example is realistic enough to normalize secret placement in config files and may lead users to mishandle credentials or disclose operational metadata externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 208)May include surrounding context.

'parse_mode': 'HTML' }

text
requests.post(url, json=data)
text

### Handle Reply

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 360)May include surrounding context.

python3 send_telegram_message.py --chat-id 123456789 --message "Test message"

Test webhook

curl -X POST https://your-domain.com/telegram/webhook
-H "Content-Type: application/json"
-d '{"message":{"chat":{"id":123},"text":"test"}}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 53)May include surrounding context.

bash
   # Method 1: Use @userinfobot
   # Method 2: Use API
   curl https://api.telegram.org/bot<TOKEN>/getUpdates
  1. Configure in OpenClaw

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 200)May include surrounding context.

bash
   # Method 1: Use @userinfobot
   # Method 2: Use API
   curl https://api.telegram.org/bot<TOKEN>/getUpdates
  1. Configure in OpenClaw

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 309)May include surrounding context.

bash
   # Method 1: Use @userinfobot
   # Method 2: Use API
   curl https://api.telegram.org/bot<TOKEN>/getUpdates
  1. Configure in OpenClaw

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 331)May include surrounding context.

bash
   # Method 1: Use @userinfobot
   # Method 2: Use API
   curl https://api.telegram.org/bot<TOKEN>/getUpdates
  1. Configure in OpenClaw

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/TELEGRAM_INTEGRATION.md (reported line 384)May include surrounding context.

bash
   # Method 1: Use @userinfobot
   # Method 2: Use API
   curl https://api.telegram.org/bot<TOKEN>/getUpdates
  1. Configure in OpenClaw