Security audit
Zulip
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Zulip bridge plugin whose sensitive messaging, monitoring, upload, and admin capabilities are largely gated and purpose-aligned.
Install with a dedicated Zulip bot account, keep HTTPS enabled, review DM and stream allowlists before enabling broad access, and leave optional high-impact settings such as enableAdminActions, historyContext, reactionTriggers, allowInsecureHttp, and enableSessionRecovery off unless you specifically need them. Note that autoSendOnMissingTool defaults to true, so completed assistant text may be sent even if the agent did not explicitly call the messaging tool.
SkillSpector was not run because this plugin release contains no bundled skills.
Endor dependency reachability
Checked Nov 11, 2026 · 12:31 AM UTC
Scan failed: Endor analysis failed. Request a rescan to try again.
