zenzap-onboarding

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:59 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches a Zenzap onboarding purpose, but it asks users to install mutable third-party code, handle API secrets unsafely, and start ongoing workspace operations without enough scoping.

Install only if you trust Zenzap and are comfortable giving the agent ongoing access to a new Zenzap workspace. Verify the plugin publisher and version manually, avoid putting API secrets in shell history or logs, and prefer a secure secret store or interactive credential entry if available. Treat the remote API documentation as reference only, and keep human confirmation around topic creation, polling duration, and any message-state changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Mandatory Third-Party Plugin Installation Is Not Version or Integrity Pinned<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–23 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```markdown ## OpenClaw-Based Agents — Plugin Setup If you are an OpenClaw-based agent, ask your human to install the Zenzap plugin **before** you proceed with anything else: ```bash openclaw plugins install @zenzap-co/openclaw-plugin ``` Once the human confirms the plugin is installed, continue with the steps below. ``` ### Technical Analysis The Skill requires OpenClaw users to install `@zenzap-co/openclaw-plugin` without specifying an audited version, immutable package digest, or integrity value. Consequently, the installed code is determined by the package registry at installation time rather than by the reviewed Skill. A package maintainer account compromise, registry compromise, or malicious future release could cause users following these instructions to install code that differs from the version originally intended or reviewed. Because a plugin generally executes within the hosting agent environment, malicious plugin code could potentially access the privileges, credentials, files, tools, and network capabilities made available to that environment. The audit did not establish that the current package is malicious. The vulnerability is the unsafe and mutable dependency acquisition mechanism. ### Attack Path 1. An attacker compromises the package publisher account, registry delivery path, or another component of the package supply chain. 2. The attacker publishes a malicious release under the existing `@zenzap-co/openclaw-plugin` package name. 3. A user follows the mandatory installation instruction without a version or integrity constraint. 4. OpenClaw resolves and installs the attacker-controlled release. 5. The malicious plugin executes with the permissions available to the OpenClaw plugin environment. 6. It may access agent data, credentials, local resources, or authorized ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the plugin to a specifically reviewed version rather than allowing installation of the registry's current release. - Verify the package using an immutable cryptographic integrity hash or signed provenance information. - Document the expected package registry, publisher identity, package version, and checksum. - Review every dependency update before changing the pinned version. - Run the plugin in a least-privilege sandbox with narrowly scoped filesystem, network, credential, and tool access. - Provide users with a verification procedure that fails closed if the package signature or digest does not match. - Maintain a dependency lock file or equivalent immutable resolution record where supported. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:114
• Finding: API Secret Is Embedded in a Command-Line Connection Token<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 114–130 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```markdown Build a connection token from three values in the `credentials` array of the `201` response: **Control Topic ID**, **API Key**, and **API Secret**. Concatenate them separated by colons and base64-encode the result: ``` base64( <Control Topic ID>:<API Key>:<API Secret> ) ``` For example, given the sample response above: ``` base64("1b383aef-...:utxDAedgfFXglaLX:66AybzV7s0afLeKKqpxC7wLKCTk5d7bT") ``` Then run: ```bash openclaw zenzap configure --token <base64Token> ``` ``` ### Technical Analysis The connection token contains the Control Topic ID, API key, and API secret. Base64 encoding provides no confidentiality and can be reversed without a key. Passing this token through the `--token` command-line argument can expose it through shell history, process argument inspection, terminal capture, diagnostic reports, command auditing, or CI/CD logs. Any system or user capable of collecting those sources may recover the original API key and API secret by decoding the token. This issue does not depend on breaking encryption because Base64 is only a transport encoding. Although the precise visibility of process arguments and shell history varies by operating system and configuration, command-line arguments are not an appropriate channel for long-lived secrets. ### Attack Path 1. The onboarding API returns an API key and API secret. 2. The user or agent concatenates those values and Base64-encodes them as instructed. 3. The encoded secret is supplied directly in the `openclaw zenzap configure --token ...` command. 4. A local user, monitoring process, shell-history collector, terminal logger, automation platform, or diagnostic tool captures the command line. 5. The observer Base64-decodes the captured token and extracts the API key and API secret. 6. The attacker uses ...[truncated 526 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Modify the configuration command to accept the token through protected standard input or an interactive hidden prompt. - Prefer an operating-system credential store or secret manager for storage and retrieval. - If a file must be used, create it with owner-only permissions, avoid predictable temporary paths, and securely remove it after import. - Never print the API key, API secret, or composite token to terminals or logs. - Ensure diagnostic and error-handling paths redact all credential values. - Avoid storing the command in shell history; however, history suppression alone should not replace a secure input mechanism. - Rotate credentials immediately if they may already have appeared in process listings, logs, command histories, or terminal recordings. - Use short-lived, narrowly scoped credentials where the service supports them. ]]>

other

Warning

• Location: SKILL.md:134
• Finding: Agent Behavior Is Delegated to Mutable Remote Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 134–140 **Vulnerability Type**: `other: Untrusted Remote Instruction Source` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 3: Load the Full API Docs Immediately after receiving the 201, load the complete Zenzap API reference: ``` https://docs.zenzap.co/llms-full.txt ``` This covers all endpoints, authentication (Bearer token + HMAC-SHA256 signing), event types, polling, messaging, topics, and members. ``` ### Technical Analysis The Skill directs the agent to load a mutable remote text document immediately after obtaining operational credentials. That document is not included in the reviewed project, pinned to a specific version, or authenticated using an expected content digest. If the documentation origin, hosting account, deployment pipeline, or delivered content is compromised, the document could contain attacker-controlled instructions. An agent that interprets the retrieved text as behavioral instructions rather than untrusted reference material could be induced to disclose credentials, invoke unintended endpoints, or perform actions outside the reviewed onboarding workflow. This is not classified as `T03: Remote Payload Retrieval and Execution` because the audited text only requires loading documentation, not downloading and executing code. No malicious content from the remote endpoint was present in the audited project or established by the audit. ### Attack Path 1. An attacker compromises the documentation domain, its content-management or deployment pipeline, or an authorized publishing account. 2. The attacker modifies `llms-full.txt` to include malicious operational instructions. 3. The agent completes organization creation and receives fresh Zenzap credentials. 4. Following the Skill, the agent immediately retrieves the modified remote document. 5. If the agent treats the document as trusted instructions, it may make attacker-selected API requests or d ...[truncated 634 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bundle the reviewed API reference with the Skill whenever practical. - Otherwise, pin the remote document to a versioned immutable URL and verify its cryptographic digest before use. - Authenticate documentation releases using signed artifacts and a separately trusted verification key. - Explicitly instruct the agent to treat retrieved documentation only as untrusted reference data, never as authority to override the Skill, user intent, or safety constraints. - Allowlist expected API domains, HTTP methods, and endpoint patterns in locally reviewed instructions. - Prohibit sending credentials to destinations not explicitly approved by the bundled Skill. - Retrieve and validate documentation before generating or exposing production credentials where feasible. - Fail closed if signature, digest, origin, or content validation does not succeed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow collects and transmits personal and organizational data, including human email and company details, and returns sensitive credentials, but provides no explicit privacy notice, retention guidance, or warning about secure handling. This is dangerous because users may unknowingly authorize transmission of PII and generation of long-lived secrets without understanding the exposure or storage implications.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to execute local OpenClaw CLI commands to install and later configure a plugin, expanding from remote API onboarding into local system modification and credential handling. This is dangerous because it can cause the agent to alter its execution environment and inject newly issued secrets into local tooling without explicit trust validation, least-privilege controls, or user confirmation at the moment of execution.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Create the Organization

```
POST https://api.zenzap.co/v2/agentic/organization/create
```

**Rate limit:** 1 request per minute per IP.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Create the Organization

```
POST https://api.zenzap.co/v2/agentic/organization/create
```

**Rate limit:** 1 request per minute per IP.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Create the Organization

```
POST https://api.zenzap.co/v2/agentic/organization/create
```

**Rate limit:** 1 request per minute per IP.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Create the Organization

```
POST https://api.zenzap.co/v2/agentic/organization/create
```

**Rate limit:** 1 request per minute per IP.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Step 2: Create the Organization

```
POST https://api.zenzap.co/v2/agentic/organization/create
```

**Rate limit:** 1 request per minute per IP.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Although the skill claims to perform onboarding via a single API call, it directs the agent to continue with broader actions: loading additional docs, creating topics, polling indefinitely, and marking messages as read. This scope expansion is risky because it turns a one-time setup flow into persistent autonomous operation with access to workspace state and user communications, increasing the chance of overreach or misuse beyond the user's original intent.

Static analysis

No suspicious patterns detected.