Asana

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:51 AM UTC
• Version: 0.2.0

Overview

This is a coherent Asana integration, but it handles a powerful PAT, live Asana mutations, and local file uploads with several safety and disclosure gaps users should review.

Install only if you are comfortable giving the skill an Asana PAT with the same authority as your account. Use the least-privileged Asana token available, avoid printing stored config values such as apiKey, test write commands in a non-production project first, and verify any file path before using upload-attachment because that file will be sent to Asana.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50
• Finding: Documentation Instructs Users to Print Stored Asana Credentials## Vulnerability Details **File Location**: `SKILL.md:50-56` **Vulnerability Type**: Credential exposure through unsafe configuration-verification instructions **Risk Level**: Medium ### Vulnerable Code Snippet ```bash **Verify what is stored:** ```bash openclaw config get skills.entries.asana openclaw config get skills.entries.asana.enabled openclaw config get skills.entries.asana.apiKey ``` ``` The same unsafe instructions also appear in `README.md:49-55`: ```bash **Verify what is stored:** ```bash openclaw config get skills.entries.asana openclaw config get skills.entries.asana.enabled openclaw config get skills.entries.asana.apiKey ``` ``` ### Technical Analysis The instructions explicitly tell users to retrieve the entire skill configuration and the `apiKey` field after storing an Asana Personal Access Token there. Unless the OpenClaw CLI independently redacts these values, these commands can print the PAT to standard output. Terminal output may be retained in shell transcripts, CI logs, support recordings, agent conversation context, or other monitoring systems. This undermines the documentation's stated goal of keeping secrets out of prompts and ad hoc shell history. The PAT transmission performed by `scripts/asana.mjs` is otherwise restricted to the fixed official Asana API endpoint and is necessary for the declared functionality. ### Attack Path 1. A user stores an Asana PAT in `skills.entries.asana.apiKey` as documented. 2. The user follows the documented verification procedure. 3. `openclaw config get skills.entries.asana` or `openclaw config get skills.entries.asana.apiKey` returns the stored credential if the CLI does not redact it. 4. The credential becomes part of terminal output, an agent transcript, CI logs, or captured session data. 5. A party with access to that output extracts the PAT. 6. The exposed PAT is submitted as a Bearer token to the Asana API. ### Impact Assessment An attacker obtaining the PAT can act with the Asana pe ...[truncated 494 chars]
• Remediation: ## Remediation Suggestions 1. Remove instructions that retrieve the full skill configuration or the `apiKey` value. 2. Retain only non-sensitive verification, such as: ```bash openclaw config get skills.entries.asana.enabled ``` 3. If credential-presence verification is required, provide a command that reports only whether a credential is configured, never its value. 4. Add an explicit warning that generic configuration reads may reveal stored secrets in terminal output, logs, or agent transcripts. 5. Ensure OpenClaw redacts `apiKey`, `ASANA_PAT`, `ASANA_TOKEN`, and equivalent secret fields from all configuration output. 6. Update both `SKILL.md:50-56` and the duplicate instructions in `README.md:49-55`. 7. Advise users who have already printed a PAT into retained output to revoke it, create a replacement token, and remove the exposed logs where feasible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (21)

Credential Access

High

• Category: Privilege Escalation

Content

## Setup (PAT)

1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token).
2. Provide it to the runtime as `ASANA_PAT`.

### Recommended: store the PAT in OpenClaw config (non-interactive)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

Authentication / PAT:

- Personal access token (PAT): https://developers.asana.com/docs/personal-access-token
- Authentication overview: https://developers.asana.com/docs/authentication

Rich text:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Memory Manipulation

High

• Category: Memory Poisoning

Content

const w = args.workspace;
      if (!w) die("Usage: set-default-workspace --workspace <workspace_gid>");
      cfg.default_workspace_gid = String(w);
      // Do not overwrite contexts, etc.
      saveConfig(cfg);
      emit({ ok: true, default_workspace_gid: cfg.default_workspace_gid, config_path: getPrimaryConfigPath() });
      return;

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The shift-project-tasks command can modify dates across many tasks in bulk, and the non-dry-run path applies changes immediately without an explicit confirmation step. In an agent context, this is dangerous because one malformed instruction or adversarial prompt can cause large-scale integrity damage to project schedules.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup (PAT)

1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token).
2. Provide it to the runtime as `ASANA_PAT`.

### Recommended: store the PAT in OpenClaw config (non-interactive)

• Confidence: 76% confidence
• Finding: The README recommends storing the PAT in OpenClaw config for non-interactive use, which introduces persistent secret storage. If that configuration is readable by other users, exposed in backups, logs, or agent diagnostics, the PAT could be recovered and used to access or modify Asana data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README includes task and project mutation commands such as create, update, add, and remove operations without clearly warning that these act on live Asana data. In an agent-skill context, that omission increases the chance of unintended destructive or integrity-impacting actions by users or autonomous agents against real workspaces.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README documents uploading local files to Asana and embedding them inline, but does not warn that local file contents will be transmitted to a third-party service. In an agent environment, this can lead to accidental exfiltration of sensitive local data if the user or agent selects the wrong file path.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes code with both environment-variable access and outbound network capability, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That weakens policy enforcement and reviewability, making it easier for a user-invocable skill handling a PAT to overreach or exfiltrate secrets if the implementation changes or is compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This section documents live create/update/remove operations against tasks and projects without a prominent warning that these commands mutate production Asana data. In an agent context, that increases the chance of unintended state changes, especially because the skill is user-invocable and mixes read and write workflows in the same guide.

Session Persistence

Medium

• Category: Rogue Agent

Content

`node {baseDir}/scripts/asana.mjs create-section --project <project_gid> --name "Blocked"`

#### Add a task to a project

Command: `add-task-to-project`

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The upload-attachment command accepts an arbitrary local path, reads the file from disk, and sends its contents to Asana. In an agent-executed skill, this creates a clear exfiltration path: a prompt or tool invocation can cause sensitive local files such as SSH keys, tokens, or project secrets to be uploaded to a remote third-party service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The same attachment upload path performs local file read and remote transmission without any user-visible warning in the execution path. In an LLM-agent context, lack of disclosure materially increases the risk of silent data exfiltration because the operator may not realize a local file is being sent to Asana.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete-attachment command issues an irreversible remote delete with no confirmation, dry-run mode, or safety interlock. In an automated agent setting, a mistaken or malicious invocation can permanently remove project artifacts and disrupt workflows without giving the user a chance to review the action.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The documentation says the events command stores a sync token locally, but it does not warn that running the command writes local state. Hidden local persistence can surprise users, affect reproducibility, and create cross-session leakage or stale-state issues in shared or sandboxed environments.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The manifest describes an Asana-management skill, but the code also persists local state under the user's home directory and later reads it back for contexts, defaults, and event sync tokens. Local config persistence is not directly part of managing Asana tasks/projects themselves and represents an additional capability beyond the stated purpose.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/asana.mjs:175