OpenClaw confluence

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill is a broad Confluence API wrapper, but it needs Review because it can use live credentials for admin and destructive operations while providing weak safeguards for credential destination, storage, and high-impact commands.

Install only if you need broad Confluence API automation and can manage the risk. Use least-privilege credentials, verify the tenant URL before every use, avoid storing tokens in the project .env, and treat delete, invite, role, admin-key, redaction, and ad-hoc calls as high-impact operations requiring separate human review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/client.js:27

Finding

Authentication Credentials Can Be Sent to an Arbitrary HTTPS Host

Content

View full analysis

{ const req = https.request(url, { method, headers }, (res) => { let data = ''; res.on('data', (chunk) => (data += chunk)); res.on('end', () => { if (res.statusCode >= 400) { return reject(new Error(normalizeError(res.statusCode, data))); } resolve(data ? JSON.parse(data) : {}); ...[truncated 2534 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/migrate-from-confluence-cli.js:27

Finding

Migration Stores Confluence Credentials in an Unprotected Project-Local Plaintext File

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill actually includes user-bulk operations, access checks by email, and invitation flows while presenting itself primarily as broad content API access, that creates a dangerous transparency gap. Hidden or under-declared user-management capabilities can enable unauthorized enumeration or provisioning actions by operators who do not realize the skill reaches identity/access functions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly requires and operationalizes high-value credentials such as API tokens or OAuth access tokens, which can provide broad access to Confluence data depending on account privileges. In the context of an agent skill that can perform arbitrary endpoint calls, credential access is especially sensitive because compromise enables large-scale data retrieval or administrative actions.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

1) Configure credentials (one of):
- **Basic**: email + API token
- **OAuth**: access token

2) Call endpoints using scripts in `scripts/`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

- OpenAPI spec: `refs/openapi-v2.v3.json`

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The spec exposes powerful administrative endpoints for space roles, available space permissions, role mode, and role assignments, including creating/updating/deleting roles and setting assignments. These capabilities go well beyond ordinary page/space content manipulation and could be abused to grant broader access, weaken tenant authorization boundaries, or reconfigure who can administer and view spaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The spec exposes powerful administrative endpoints for space roles, available space permissions, role mode, and role assignments, including creating/updating/deleting roles and setting assignments. These capabilities go well beyond ordinary page/space content manipulation and could be abused to grant broader access, weaken tenant authorization boundaries, or reconfigure who can administer and view spaces.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/client.js (reported line 7)May include surrounding context.

js

const path = require('path');

const src = path.join(process.env.HOME || '', '.confluence-cli', 'config.json');
const dst = path.join(__dirname, '..', '.env');

if (!fs.existsSync(src)) {
  console.error('No confluence-cli config found at ' + src);

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/migrate-from-confluence-cli.js (reported line 6)May include surrounding context.

js

const path = require('path');

const src = path.join(process.env.HOME || '', '.confluence-cli', 'config.json');
const dst = path.join(__dirname, '..', '.env');

if (!fs.existsSync(src)) {
  console.error('No confluence-cli config found at ' + src);

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples encourage broad listing and ad-hoc API calls against a Confluence tenant without warning that results may include sensitive pages, labels, metadata, or other workspace information. In an agent setting, this increases the risk of oversharing, bulk data exposure, and accidental retrieval beyond the minimum necessary scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs users to place API tokens and OAuth tokens in environment variables or local config files but does not warn about secret leakage through shell history, process inspection, logs, screenshots, backups, or accidental repository commits. In practice, this normalizes insecure secret handling and can lead to credential compromise for an entire Confluence workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The spec exposes powerful administrative endpoints for space roles, available space permissions, role mode, and role assignments, including creating/updating/deleting roles and setting assignments. These capabilities go well beyond ordinary page/space content manipulation and could be abused to grant broader access, weaken tenant authorization boundaries, or reconfigure who can administer and view spaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script exposes create/get/delete operations for an /admin-key endpoint, which is a privileged capability not explained by the Confluence REST API v2 skill description. In a broadly scoped API skill, undocumented administrative credential management increases the chance of hidden backdoor-like behavior, privilege escalation, or unsafe secret handling, especially because the script makes these actions easily callable from the CLI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script allows immediate deletion of the administrative key via DELETE /admin-key with no confirmation prompt, dry-run, or secondary safety control. That makes accidental or malicious invocation easier, potentially breaking administrative access, disrupting integrations, or interfering with incident response and account recovery workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script performs a DELETE request against /app/properties/${key} immediately when the delete command is used. There is no confirmation prompt, warning message, or explanatory comment indicating that this operation removes data, which can make a destructive action easy to trigger unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script exposes a destructive DELETE operation directly from the command line and executes it immediately with no confirmation prompt, dry-run mode, or additional safety guard. In an automation-oriented Confluence API skill, this increases the chance of accidental or scripted deletion of attachments, especially when IDs are mistyped, variables are empty, or commands are reused in bulk workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a Confluence Cloud REST API v2 skill covering pages, spaces, folders, databases, whiteboards, comments, labels, tasks, and properties, but this file exclusively exposes /blogposts list/get/create/update/delete commands. 'Blogposts' are not mentioned in the stated scope, so the code behavior extends beyond what the manifest claims this skill does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script exposes reset and delete operations that change or remove classification settings via POST/DELETE requests, but there is no confirmation prompt, warning message, or explanatory comment around these irreversible actions. A user invoking these commands from the CLI receives no disclosure that the operation will reset or delete classification defaults.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script exposes a destructive delete command that immediately issues a DELETE request against the Confluence databases API with no confirmation prompt, dry-run mode, or safeguard against accidental invocation. In an authenticated administrative context, a typo, bad automation input, or mistaken command usage could permanently remove data or trigger destructive actions more easily than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a Confluence Cloud REST API v2 skill covering pages, spaces, folders, databases, whiteboards, comments, labels, tasks, and properties, but this file exposes CRUD-style operations for an /embeds endpoint. Because embeds are not part of the stated scope and are not hinted at in the description, the code's behavior exceeds what the skill claims to cover.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.