Security audit

ZARZOOM

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly described ZARZOOM social-posting integration, with expected use of a user-provided API key and external posting APIs.

Before installing, treat the ZARZOOM API key like a password: use the narrowest scopes you need, protect the OpenClaw config file, and rotate the key if it may have been exposed. Review posts, target platforms, cancellations, and calendar edits carefully before approving actions because the skill can change real external posting state.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states the skill will activate automatically when the assistant detects 'ZARZOOM-relevant intent,' but it does not define a narrow trigger boundary. For a skill that can submit content and use a customer API key to perform external actions, ambiguous auto-invocation can cause unintended posting workflows, accidental data disclosure to the third-party service, or surprise use of write-capable credentials.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill instructs users to place a long-lived API key directly into a local JSON configuration file under the skill entry, creating persistent storage of a bearer credential. If that file is read by other local users, malware, backups, logs, or support tooling, the key could be stolen and used to submit content, read analytics, inspect submissions, or manipulate posting state on the user's behalf.
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
primaryEnv: ZARZOOM_API_KEY envVars: - name: ZARZOOM_API_KEY description: Your ZARZOOM developer API key. Create one at https://zarzoom.com/dashboard/api-keys. required: true requires: env: ["ZARZOOM_API_KEY"]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill sends user-provided articles, images, videos, analytics queries, and connected-platform metadata to an external service, but the user-facing description does not prominently disclose that third-party transmission or the compliance/admin review workflow before data leaves the local environment. This can lead users to share sensitive or proprietary content without informed consent, especially because the skill also accesses account/platform status and submission history.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The error-handling guidance tells the agent to direct users to paste a replacement API key into a persistent local config path, reinforcing insecure long-term storage of a bearer token. Repeatedly steering users toward plaintext credential storage increases the chance of credential exposure through local compromise, syncing, backups, or accidental disclosure.
Content: Scanner excerpt · SKILL.md (reported line 666)May include surrounding context.
md
- **`401 unauthorized`** — the `ZARZOOM_API_KEY` is missing, malformed, or revoked. Tell the user: > "Your ZARZOOM API key isn't working. Create a new one at > https://zarzoom.com/dashboard/api-keys and paste it into > `~/.openclaw/openclaw.json` under `skills.entries.zarzoom.env.ZARZOOM_API_KEY`."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This reference prominently documents numerous state-changing endpoints, including content creation and cancellation actions, but does not warn that these operations can publish, withdraw, or otherwise alter customer content and workflow state. In an agent skill context, that omission increases the chance an autonomous agent or user invokes destructive or user-impacting actions without explicit confirmation, especially because write and cancel routes appear alongside read-only routes in a quick-reference format.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · reference/error-codes.md (reported line 40)May include surrounding context.
md
**Recovery:** tell the user verbatim: > "Your ZARZOOM API key isn't working. Create a new one at > https://zarzoom.com/dashboard/api-keys and paste it into your > `~/.openclaw/openclaw.json` under > `skills.entries.zarzoom.env.ZARZOOM_API_KEY`."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples show the skill uploading media and submitting content to external social platforms without any user-facing notice that their text, images, and metadata will be transmitted outside the assistant to ZARZOOM and onward to connected accounts. This can cause unintended disclosure of sensitive content or surprise posting behavior, especially if users assume the assistant is only drafting or previewing content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The status-check flow states that if no submission ID is provided, the skill may query recent submissions to infer the target item, but it does not warn the user that prior account activity will be inspected. While this is a limited privacy issue, it can expose or summarize historical activity the user did not explicitly ask to retrieve by identifier.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.