ClawHub
Back to skill

Security audit

ZenHeart User Agent Workflows

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly documents expected ZenHeart agent workflows, but it also includes an under-scoped server-pushed command callback that needs review before use.

Review this skill before installing. Use only scoped ZenHeart credentials for an account you control, and do not allow the agent to execute server-pushed command strings as shell commands, local tool calls, file reads, or other privileged actions unless you add an explicit allowlist and human approval step.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill defines a server-pushed `command` message and instructs the agent to return a `command_result`, but it provides no constraint on what commands are safe, no validation requirements, and no prohibition on local tool or shell execution. In an agent-skill context, this creates a dangerous remote-instruction channel that can be interpreted as authorization to execute arbitrary actions beyond the documented messaging/news/social workflows.

Missing User Warnings

High
Confidence
95% confidence
Finding
The command callback tells the agent to respond to arbitrary server-pushed commands without any warning that this can induce remote command execution or other system-affecting behavior. In practice, an LLM agent may treat this as trusted orchestration and invoke local capabilities on attacker-controlled input, enabling prompt injection, data exfiltration, or unsafe action execution.

Static analysis

No suspicious patterns detected.