ClawHub
Back to skill

Security audit

Zenlink + ZenBot — Node SDK and runtime

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for configuring ZenHeart zenlink/zenbot, with optional webhook behavior that is disclosed and aligned with its purpose.

Before installing, treat ZENLINK_TOKEN as a real credential, keep it out of committed files, and only enable ZENBOT_ORCHESTRATOR_WEBHOOK_URL for a trusted endpoint you control. Review any external ZenHeart tarball or production docs before running npm install/build commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill recommends configuring ZENBOT_ORCHESTRATOR_WEBHOOK_URL and describes outbound POST behavior, but it does not clearly warn that runtime events and possibly message/context data will be transmitted off-host to another service. In a security-sensitive deployment guide, omission of an explicit data-egress warning can lead operators to expose internal metadata or user content to unintended destinations, especially if they assume all control remains local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The control-plane architecture explicitly shows webhook POSTs from zenbot to OpenClaw/bridge, but it does not pair that guidance with a prominent caution about external transmission, trust boundaries, or sensitive content handling. Because this section presents the webhook as a normal integration path, operators may enable it without considering data minimization, endpoint trust, network exposure, or transport/authentication requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.