T08 · Insecure Dependencies
Error
- Location
SKILL.md:15- Finding
Mandatory Third-Party Plugin Installation Is Not Version or Integrity Pinned
- Content
View full analysis
- Remediation
View remediation
Security audit
zenzap-onboarding
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches a Zenzap onboarding purpose, but it asks users to install mutable third-party code, handle API secrets unsafely, and start ongoing workspace operations without enough scoping.
Install only if you trust Zenzap and are comfortable giving the agent ongoing access to a new Zenzap workspace. Verify the plugin publisher and version manually, avoid putting API secrets in shell history or logs, and prefer a secure secret store or interactive credential entry if available. Treat the remote API documentation as reference only, and keep human confirmation around topic creation, polling duration, and any message-state changes.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:114- Finding
API Secret Is Embedded in a Command-Line Connection Token
- Content
View full analysis
:: ) ``` For example, given the sample response above: ``` base64("1b383aef-...:utxDAedgfFXglaLX:66AybzV7s0afLeKKqpxC7wLKCTk5d7bT") ``` Then run: ```bash openclaw zenzap configure --token ``` ``` ### Technical Analysis The connection token contains the Control Topic ID, API key, and API secret. Base64 encoding provides no confidentiality and can be reversed without a key. Passing this token through the `--token` command-line argument can expose it through shell history, process argument inspection, terminal capture, diagnostic reports, command auditing, or CI/CD logs. Any system or user capable of collecting those sources may recover the original API key and API secret by decoding the token. This issue does not depend on breaking encryption because Base64 is only a transport encoding. Although the precise visibility of process arguments and shell history varies by operating system and configuration, command-line arguments are not an appropriate channel for long-lived secrets. ### Attack Path 1. The onboarding API returns an API key and API secret. 2. The user or agent concatenates those values and Base64-encodes them as instructed. 3. The encoded secret is supplied directly in the `openclaw zenzap configure --token ...` command. 4. A local user, monitoring process, shell-history collector, terminal logger, automation platform, or diagnostic tool captures the command line. 5. The observer Base64-decodes the captured token and extracts the API key and API secret. 6. The attacker uses ...[truncated 526 chars]- Remediation
View remediation
other
Warning
- Location
SKILL.md:134- Finding
Agent Behavior Is Delegated to Mutable Remote Documentation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow collects and transmits personal and organizational data, including human email and company details, and returns sensitive credentials, but provides no explicit privacy notice, retention guidance, or warning about secure handling. This is dangerous because users may unknowingly authorize transmission of PII and generation of long-lived secrets without understanding the exposure or storage implications.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to execute local OpenClaw CLI commands to install and later configure a plugin, expanding from remote API onboarding into local system modification and credential handling. This is dangerous because it can cause the agent to alter its execution environment and inject newly issued secrets into local tooling without explicit trust validation, least-privilege controls, or user confirmation at the moment of execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Create the Organization
text POST https://api.zenzap.co/v2/agentic/organization/createRate limit: 1 request per minute per IP.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Create the Organization
text POST https://api.zenzap.co/v2/agentic/organization/createRate limit: 1 request per minute per IP.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Create the Organization
text POST https://api.zenzap.co/v2/agentic/organization/createRate limit: 1 request per minute per IP.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Create the Organization
text POST https://api.zenzap.co/v2/agentic/organization/createRate limit: 1 request per minute per IP.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 2: Create the Organization
text POST https://api.zenzap.co/v2/agentic/organization/createRate limit: 1 request per minute per IP.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Although the skill claims to perform onboarding via a single API call, it directs the agent to continue with broader actions: loading additional docs, creating topics, polling indefinitely, and marking messages as read. This scope expansion is risky because it turns a one-time setup flow into persistent autonomous operation with access to workspace state and user communications, increasing the chance of overreach or misuse beyond the user's original intent.
- Content