Security audit

Zoho Cliq

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Zoho Cliq channel plugin that uses OAuth and a protected webhook to connect OpenClaw to Cliq; I found no hidden install behavior or unrelated data access.

Install only if you intend to let OpenClaw operate as a Zoho Cliq bot. Use a strong webhookSecret, prefer SecretRefs or environment-backed secrets for clientSecret and refreshToken, keep dmPolicy on allowlist or pairing unless the workspace is trusted, and grant only the Zoho OAuth scopes needed for the features you will use.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/setup-wizard.js:9
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/account-inspect.test.ts:86
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/capabilities.test.ts:299
Evidence: Authorization: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/client-logging.test.ts:38
Evidence: const oauthBody = opts.oauthBody ?? { access_token: "[REDACTED]", expires_in: 3600 };

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-contract.test.ts:109
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-resolve.test.ts:24
Evidence: const cfg = cfgWith({ clientSecret: "[REDACTED]" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.ts:26
Evidence: clientSecret: "[REDACTED]",