ClawHub
Back to skill

Security audit

Zen+ Health

Security checks for vulnerabilities and agentic risk

Overview

This wellness skill is mostly coherent and read-only, but it handles sensitive health-adjacent account data with broad triggers and sends the API key to a configurable endpoint without built-in validation.

Review before installing. Use only a dedicated, revocable read-only Zen+ Health API key; set ZEN_API_BASE_URL exactly to the official HTTPS API endpoint; avoid shared or logged workspaces for personal wellness queries; and ask the agent to confirm before fetching profile, notification, timeline, or schedule data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Bearer API Key Can Be Sent to an Untrusted Configurable Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8-9, 44-45, 56-89, 97-110
Vulnerability Type: Unrestricted credential destination
Risk Level: Medium

The Skill defines the API destination through an environment variable and then sends the Zen+ Health bearer credential to that destination without requiring validation of its scheme, host, port, or embedded credentials.

yaml
base_url_env: ZEN_API_BASE_URL
api_key_env: ZEN_API_KEY

The vulnerable pattern appears in all documented API commands, including:

bash
curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/notifications?limit=10"
bash
curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/timeline?days=7"
bash
curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/catalog"
bash
curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me"

The response-processing examples repeat the same behavior:

bash
# Get notification titles
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/notifications" | jq -r '.notifications[].title'

# Count timeline events
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/timeline" | jq '.events | length'

# List catalogue categories
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/catalog" | jq -r '.tasks[].category' | sort -u

Technical Analysis

ZEN_API_BASE_URL is externally configurable and is interpolated directly into each curl destination. The Skill does not require the agent or a wrapper to verify that the parsed URL:

  • Uses HTTPS.
  • Has the exact approved hostname api.zenplus.health.
  • Uses an approved port.
  • Contains no embedded credentials or malformed URL components.

As a result, configuration tampering or setup error ...[truncated 1828 chars]

Remediation
View remediation

Remediation Suggestions

  1. Hardcode https://api.zenplus.health as the API origin if alternative environments are not strictly required.
  2. If configurability is necessary, place all requests behind a wrapper that parses and validates the URL before adding the authorization header.
  3. Require:
    • The https scheme.
    • An exact hostname allowlist, such as api.zenplus.health.
    • An approved port, normally 443.
    • No username or password component.
    • No ambiguous or malformed hostname encoding.
  4. Fail closed if validation fails; do not fall back to the supplied URL.
  5. Perform structured URL parsing rather than prefix or substring checks. For example, a value such as https://api.zenplus.health.attacker.example must not pass validation.
  6. Add the bearer header only after destination validation.
  7. Prevent commands, debug traces, error handling, and API response logs from exposing the credential.
  8. Use a dedicated, revocable key with only the scopes required by enabled Skill features.
  9. Consider separating public catalogue access from authenticated personal-data operations so credentials are not attached where authentication is unnecessary.
  10. Update SECURITY.md to distinguish recommended configuration from enforced controls and document the destination-validation requirement.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill handles highly sensitive wellness-related information, including mood-adjacent activity history, notifications, and user profile data, but the user-facing description does not clearly warn that data will be fetched from an external third-party service. This undermines informed consent and increases the chance that private mental-health-related information is accessed or disclosed without the user's clear understanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README encourages connecting an API key to expose wellness notifications, timeline, profile data, and working-hours preferences, but it does not clearly warn that these may constitute sensitive personal or health-adjacent data. In a chat-platform integration context, users may disclose or route this information through third-party systems, logs, or shared workspaces without understanding the privacy implications, increasing the risk of unintended exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are very broad and include common emotional states and everyday requests such as feeling stressed, wanting to relax, or asking for self-care ideas. Because this skill requires authentication and can retrieve sensitive wellness, profile, notification, and timeline data from a third-party service, overbroad triggering creates a real risk of unintended invocation and unnecessary access to private information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.