Security audit

Asana

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Asana integration, but it handles a powerful PAT, live Asana mutations, and local file uploads with several safety and disclosure gaps users should review.

Install only if you are comfortable giving the skill an Asana PAT with the same authority as your account. Use the least-privileged Asana token available, avoid printing stored config values such as apiKey, test write commands in a non-production project first, and verify any file path before using upload-attachment because that file will be sent to Asana.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:50
Finding: Documentation Instructs Users to Print Stored Asana Credentials
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:50-56
Vulnerability Type: Credential exposure through unsafe configuration-verification instructions
Risk Level: Medium

Vulnerable Code Snippet

bash
**Verify what is stored:** ```bash openclaw config get skills.entries.asana openclaw config get skills.entries.asana.enabled openclaw config get skills.entries.asana.apiKey

text
The same unsafe instructions also appear in `README.md:49-55`: ```bash **Verify what is stored:** ```bash openclaw config get skills.entries.asana openclaw config get skills.entries.asana.enabled openclaw config get skills.entries.asana.apiKey

text
### Technical Analysis The instructions explicitly tell users to retrieve the entire skill configuration and the `apiKey` field after storing an Asana Personal Access Token there. Unless the OpenClaw CLI independently redacts these values, these commands can print the PAT to standard output. Terminal output may be retained in shell transcripts, CI logs, support recordings, agent conversation context, or other monitoring systems. This undermines the documentation's stated goal of keeping secrets out of prompts and ad hoc shell history. The PAT transmission performed by `scripts/asana.mjs` is otherwise restricted to the fixed official Asana API endpoint and is necessary for the declared functionality. ### Attack Path 1. A user stores an Asana PAT in `skills.entries.asana.apiKey` as documented. 2. The user follows the documented verification procedure. 3. `openclaw config get skills.entries.asana` or `openclaw config get skills.entries.asana.apiKey` returns the stored credential if the CLI does not redact it. 4. The credential becomes part of terminal output, an agent transcript, CI logs, or captured session data. 5. A party with access to that output extracts the PAT. 6. The exposed PAT is submitted as a Bearer token to the Asana API. ### Impact Assessment An attacker obtaining the PAT can act with the Asana pe ...[truncated 494 chars]
Remediation: View remediation
Remediation Suggestions

Remove instructions that retrieve the full skill configuration or the apiKey value.

Retain only non-sensitive verification, such as:

bash
openclaw config get skills.entries.asana.enabled

If credential-presence verification is required, provide a command that reports only whether a credential is configured, never its value.

Add an explicit warning that generic configuration reads may reveal stored secrets in terminal output, logs, or agent transcripts.

Ensure OpenClaw redacts apiKey, ASANA_PAT, ASANA_TOKEN, and equivalent secret fields from all configuration output.

Update both SKILL.md:50-56 and the duplicate instructions in README.md:49-55.

Advise users who have already printed a PAT into retained output to revoke it, create a replacement token, and remove the exposed logs where feasible.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (21)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
## Setup (PAT) 1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token). 2. Provide it to the runtime as `ASANA_PAT`. ### Recommended: store the PAT in OpenClaw config (non-interactive)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · AGENTS.md (reported line 13)May include surrounding context.
md
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 3)May include surrounding context.
md
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
md
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/asana.mjs (reported line 5)May include surrounding context.
js
--- name: asana description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)." homepage: https://developers.asana.com/docs/personal-access-token user-invocable: true metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/REFERENCE.md (reported line 12)May include surrounding context.
md
Authentication / PAT: - Personal access token (PAT): https://developers.asana.com/docs/personal-access-token - Authentication overview: https://developers.asana.com/docs/authentication Rich text:

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/asana.mjs (reported line 516)May include surrounding context.
js
const w = args.workspace; if (!w) die("Usage: set-default-workspace --workspace <workspace_gid>"); cfg.default_workspace_gid = String(w); // Do not overwrite contexts, etc. saveConfig(cfg); emit({ ok: true, default_workspace_gid: cfg.default_workspace_gid, config_path: getPrimaryConfigPath() }); return;

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The shift-project-tasks command can modify dates across many tasks in bulk, and the non-dry-run path applies changes immediately without an explicit confirmation step. In an agent context, this is dangerous because one malformed instruction or adversarial prompt can cause large-scale integrity damage to project schedules.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The README recommends storing the PAT in OpenClaw config for non-interactive use, which introduces persistent secret storage. If that configuration is readable by other users, exposed in backups, logs, or agent diagnostics, the PAT could be recovered and used to access or modify Asana data.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
## Setup (PAT) 1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token). 2. Provide it to the runtime as `ASANA_PAT`. ### Recommended: store the PAT in OpenClaw config (non-interactive)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README includes task and project mutation commands such as create, update, add, and remove operations without clearly warning that these act on live Asana data. In an agent-skill context, that omission increases the chance of unintended destructive or integrity-impacting actions by users or autonomous agents against real workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README documents uploading local files to Asana and embedding them inline, but does not warn that local file contents will be transmitted to a third-party service. In an agent environment, this can lead to accidental exfiltration of sensitive local data if the user or agent selects the wrong file path.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes code with both environment-variable access and outbound network capability, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. That weakens policy enforcement and reviewability, making it easier for a user-invocable skill handling a PAT to overreach or exfiltrate secrets if the implementation changes or is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This section documents live create/update/remove operations against tasks and projects without a prominent warning that these commands mutate production Asana data. In an agent context, that increases the chance of unintended state changes, especially because the skill is user-invocable and mixes read and write workflows in the same guide.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
`node {baseDir}/scripts/asana.mjs create-section --project <project_gid> --name "Blocked"` #### Add a task to a project Command: `add-task-to-project`

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The upload-attachment command accepts an arbitrary local path, reads the file from disk, and sends its contents to Asana. In an agent-executed skill, this creates a clear exfiltration path: a prompt or tool invocation can cause sensitive local files such as SSH keys, tokens, or project secrets to be uploaded to a remote third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The same attachment upload path performs local file read and remote transmission without any user-visible warning in the execution path. In an LLM-agent context, lack of disclosure materially increases the risk of silent data exfiltration because the operator may not realize a local file is being sent to Asana.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The delete-attachment command issues an irreversible remote delete with no confirmation, dry-run mode, or safety interlock. In an automated agent setting, a mistaken or malicious invocation can permanently remove project artifacts and disrupt workflows without giving the user a chance to review the action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation says the events command stores a sync token locally, but it does not warn that running the command writes local state. Hidden local persistence can surprise users, affect reproducibility, and create cross-session leakage or stale-state issues in shared or sandboxed environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes an Asana-management skill, but the code also persists local state under the user's home directory and later reads it back for contexts, defaults, and event sync tokens. Local config persistence is not directly part of managing Asana tasks/projects themselves and represents an additional capability beyond the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/asana.mjs:175

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Memory Manipulation

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Session Persistence

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Static analysis

Environment variable access combined with network send.