Security audit

Zoho Cliq

Security checks for vulnerabilities and agentic risk

Overview

This package is a disclosed Zoho Cliq channel plugin that needs chat and OAuth access to do its stated job, with no evidence of hidden or unrelated behavior.

Install only if you intend to connect OpenClaw to a Zoho Cliq workspace. Review the requested Zoho OAuth scopes, keep dmPolicy/allowFrom and group policies tight, store clientSecret/webhookSecret/refreshToken as SecretRefs or environment-backed secrets, and allow the message tool/media sending only for agents and chats you trust.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/src/oauth-exchange-command.js:94
Evidence: const code = options.code?.trim() || stringValue(process.env[CLIQ_AUTH_CODE_ENV]);

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/oauth-exchange-command.ts:137
Evidence: const code = options.code?.trim() || stringValue(process.env[CLIQ_AUTH_CODE_ENV]);

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/provision-command.js:17
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/setup-wizard.js:73
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/account-inspect.test.ts:106
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/capabilities.test.ts:428
Evidence: Authorization: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/client-logging.test.ts:38
Evidence: const oauthBody = opts.oauthBody ?? { access_token: "[REDACTED]", expires_in: 3600 };

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/config-validation.test.ts:103
Evidence: { ...BASE, clientSecret: "[REDACTED]", webhookSecret: "wh" },

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/doctor-runner.test.ts:20
Evidence: const CLIENT_SECRET = "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/handler-secret-exposure.test.ts:98
Evidence: const clientSecret = "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/oauth-exchange-command.test.ts:107
Evidence: JSON.stringify({ access_token: "[REDACTED]", scope: FULL_SCOPE_STRING }),

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/provision-command.test.ts:92
Evidence: CLIQ_CLIENT_SECRET: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/provision-command.ts:52
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-contract.test.ts:125
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-resolve.test.ts:27
Evidence: const cfg = cfgWith({ clientSecret: "[REDACTED]" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/security-audit.test.ts:319
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.test.ts:861
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.ts:120
Evidence: clientSecret: "[REDACTED]",