Zrise Connect Release

• Outcome: Review
• Latest audit: May 28, 2026 · 11:50 AM UTC
• Version: 3.3.1

Overview

This appears to be a real Zrise automation skill, but it combines live business-data changes, credentialed remote access, privileged agent execution, and weak defaults that users should review before installing.

Install only in a test or tightly controlled workspace first. Before using production Zrise data, re-enable verified TLS, configure WORKFLOW_UI_TOKEN and bind the UI to localhost where possible, use least-privilege Zrise credentials, avoid real task IDs during onboarding, and require explicit review before writeback, timesheet creation, stage transitions, or knowledge-base updates.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    
    # Call agent
    result = subprocess.run(
        [
            'openclaw', 'agent',
            '--agent', agent_id,

• Confidence: 94% confidence
• Finding: This subprocess call launches an external agent and passes untrusted task name/description/feedback directly as the agent prompt. While there is no shell injection because arguments are passed as a list, this is still a real security issue because attacker-controlled task content can perform prompt injection against the downstream agent and induce unauthorized actions, data access, or write-back operations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # Method 1: Try using openclaw CLI if available
        result = subprocess.run(
            ['openclaw', 'invoke', '--agent', 'zrise-analyst', '--task', full_prompt],
            capture_output=True,
            text=True,

• Confidence: 94% confidence
• Finding: The code executes an external CLI and passes task metadata, description, and optional feedback directly as an argument. Although it avoids shell=True, it still sends untrusted and potentially sensitive content to another executable, creating a data-exposure and trust-boundary issue if the CLI is compromised, logs arguments, or behaves unexpectedly.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The example webhook/message handler performs privileged actions such as approve_task() and reject_task() based only on message text, without verifying the sender's Telegram identity or authorization. In a Telegram integration, this can allow any user who can reach the bot or webhook to trigger workflow approvals or rejections, leading to unauthorized task state changes and business process abuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The workflow runner launches Claude with `--permission-mode bypassPermissions`, which disables an important safety boundary for a model that receives partially untrusted content derived from workflow items, prior outputs, and configuration. Because prompts can instruct the agent to run tools or access local resources, this setting can turn prompt injection or malicious task content into unauthorized file access, command execution, or broader system actions.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The workflow launcher performs host-level file attribute modification across all Python files in the scripts directory using xattr before executing workflows. A web-facing UI should not silently mutate host filesystem metadata as a side effect of task execution, because this expands the skill from workflow management into system tampering and weakens local platform protections such as quarantine/provenance checks.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill instructs users to clone, install, compile, and symlink an external GitHub repository directly into their PATH without any pinning, checksum verification, provenance note, or trust warning. This creates a supply-chain risk: if the repository, dependency chain, or referenced branch is compromised, an operator could execute attacker-controlled code during npm install, build, or later via the lobster command.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding guide instructs users to test workflows against real task IDs and then check results on the live Zrise instance, but it does not warn that these steps can create or modify production task data. In a workflow system that fetches, processes, and posts results, omission of this warning can lead users to unintentionally alter real records during onboarding or experimentation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example for posting comments to Zrise provides a ready-to-run command against a real task ID without any caution that it updates a remote task record. This lowers the barrier to accidental writes, allowing users to post unintended content to live tasks and potentially expose internal or AI-generated information in production workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide includes a realistic-looking bot token directly in examples and shows storing it in a local config file without an explicit warning that the token is a secret. Readers may copy this pattern into source-controlled configs, leak credentials, and enable attackers to control the bot, read updates, or impersonate system messages.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation encourages sending task notifications, approval requests, previews, status updates, and employee interactions over Telegram, but does not clearly warn that this transmits organizational work data to a third-party messaging service. In this context, task names, workflow output, links, and approval content may contain internal or sensitive business information, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to place a Telegram bot token directly into a curl command against the Telegram API, but provides no warning that the token is a secret credential. In practice, this increases the chance the token will be exposed through shell history, screenshots, logs, shared notes, or copied commands, allowing unauthorized parties to control the bot.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The config example shows storing the Telegram bot token in a local plaintext configuration file without any guidance on file permissions, secret storage, or exclusion from version control. This can lead to credential leakage via backups, local compromise, accidental commits, or sharing of configuration files, enabling unauthorized bot access.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script transmits task contents, including description and link, to an external agent process without explicit disclosure or consent. In this skill context, task descriptions may contain sensitive internal project data, so forwarding them to another agent boundary creates a real confidentiality risk even if the agent runs 'locally'.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: When invoked with --save, the script persists task details, descriptions, comments, project names, and links into a shared .tasks directory on disk without any explicit consent prompt, retention control, or visibility warning. Because this data originates from an external task system and may include sensitive business content, local persistence can unintentionally expose information to other local users, processes, or later workflow steps that access the shared folder.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script persists workflow state, including task details, user messages, plans, results, and feedback, to predictable local JSON files under .workflow-state without any access controls, encryption, or retention policy. On multi-user systems or shared workspaces, this can leak sensitive task content and create an unintended local data store that survives beyond the workflow run.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill retrieves task metadata, descriptions, and recent comments from Zrise and prints them directly, but there is no validation of caller authorization, scope restriction, or user-facing notice that potentially sensitive project data is being accessed. In an agent setting, this can enable unintended data exposure if an untrusted prompt or workflow causes the tool to be invoked on arbitrary task IDs.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code globally disables TLS certificate validation and hostname checking, then uses that insecure SSL context for XML-RPC authentication requests carrying a username and password or API key. This enables man-in-the-middle interception or redirection to a malicious endpoint, allowing credential theft and unauthorized access to the remote Zrise system. In this skill context, the risk is elevated because the helper centralizes authenticated remote access, so any consumer of this utility inherits the insecure transport silently.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description 'Zrise integration skill - Automate tasks with AI workflows' is broad and does not define clear activation boundaries, allowed operations, or trust constraints. In a skill that includes task automation, workflow execution, UI components, polling, and multiple AI-driven scripts, vague scope can cause over-invocation, unintended task execution, or misuse in contexts the author did not explicitly constrain.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: User-provided feedback and task description are inserted verbatim into the model prompt, so untrusted text can steer model behavior, override the intended workflow, or cause unnecessary disclosure or repetition of sensitive task data. In this skill context, task descriptions likely come from project-management systems and may contain internal business details, making prompt-injection and data-leakage more dangerous.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The prompt combines system-like role instructions with untrusted task content in a single natural-language context, creating a classic prompt-injection surface. A malicious task description or feedback string could direct the agent to ignore prior instructions, change output scope, or surface sensitive task context, which is particularly relevant because this wrapper is designed to process externally sourced task records.

Static analysis

No suspicious patterns detected.