Security audit
Security checks for vulnerabilities and agentic risk
This is a real Asana integration, but it needs review because it can use a long-lived Asana token to change or delete live workspace data, including bulk timeline changes, without built-in confirmation.
Install only if you trust the agent to operate in the connected Asana workspace. Use the least-privileged or most limited PAT available, avoid displaying stored apiKey values, test write commands in a test project first, and require human review before deletes, uploads, membership changes, or timeline-shift commands. Remove or rotate the PAT when it is no longer needed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Setup (PAT)
1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token).
2. Provide it to the runtime as `ASANA_PAT`.
### Recommended: store the PAT in OpenClaw config (non-interactive)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
---
name: asana
description: "Manage Asana tasks, projects, briefs, status updates, custom fields, dependencies, attachments, events, and timelines via Personal Access Token (PAT)."
homepage: https://developers.asana.com/docs/personal-access-token
user-invocable: true
metadata: {"openclaw":{"requires":{"env":["ASANA_PAT"]},"primaryEnv":"ASANA_PAT","homepage":"https://developers.asana.com/docs/personal-access-token"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Authentication / PAT:
- Personal access token (PAT): https://developers.asana.com/docs/personal-access-token
- Authentication overview: https://developers.asana.com/docs/authentication
Rich text:
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
const w = args.workspace;
if (!w) die("Usage: set-default-workspace --workspace <workspace_gid>");
cfg.default_workspace_gid = String(w);
// Do not overwrite contexts, etc.
saveConfig(cfg);
emit({ ok: true, default_workspace_gid: cfg.default_workspace_gid, config_path: getPrimaryConfigPath() });
return;
The delete-attachment command issues a DELETE request directly against the Asana API and immediately emits the result. There is no confirmation prompt, warning comment, or user-facing disclosure near the deletion path, making an irreversible action easy to trigger silently.
The timeline-shifting commands can rewrite dates across one task plus subtasks or an entire project, and the help text explicitly labels them 'use with care'. Despite the potentially broad and irreversible impact, the execution path performs bulk updates without any confirmation or mandatory dry-run step.
The README explicitly recommends storing the Asana PAT in persistent OpenClaw configuration, which creates session persistence for a powerful credential. If the local config store, workspace, or container environment is later accessed by another process, plugin, or user, the token can be reused to access and modify Asana data beyond the current session.
## Setup (PAT)
1. Create a PAT: Asana → Developer App / PAT settings (see Asana docs: Personal access token).
2. Provide it to the runtime as `ASANA_PAT`.
### Recommended: store the PAT in OpenClaw config (non-interactive)
The README documents multiple state-changing operations against live Asana data, such as creating tasks, updating tasks, posting comments, and adding or removing tasks from projects, without an explicit warning that these commands modify remote workspace data. In an agent-skill context, that omission increases the chance of accidental execution against production projects or user tasks, especially when examples are copied verbatim.
The skill explicitly requires environment access for a PAT and performs outbound network calls to the Asana API, but it does not declare any tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and reviewability, making it easier for an agent runtime to grant broader capabilities than readers of the manifest would expect.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
`node {baseDir}/scripts/asana.mjs create-section --project <project_gid> --name "Blocked"`
#### Add a task to a project
Command: `add-task-to-project`
The script writes local configuration data to disk via fs.writeFileSync, which changes user state outside Asana. Although the help text mentions config helpers are stored locally, this code path itself has no confirmation prompt, logging, or inline warning at the write operation, so the file modification can happen silently when commands like set-context or use-context run.
upload-attachment reads a local file from disk and sends its contents over the network to Asana using multipart form data. While uploading is part of the command purpose, there is no explicit runtime disclosure that a local file will be read and transmitted, which is safety-relevant for user data handling.
append-inline-image fetches existing rich text and then updates html_notes or html_text, modifying remote user content in place. Even though the command name suggests editing, there is no explicit disclosure that the script will rewrite the target field contents, which is a user-data-affecting operation.
The documentation states that the events command stores a sync token locally, but it gives no warning about filesystem persistence, retention, or multi-user/shared-run exposure. While a sync token is not equivalent to a PAT, persistent local state can leak operational metadata or be reused unexpectedly across sessions and sandboxes.
Detected: suspicious.env_credential_access