Security audit

Zoho Cliq

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Zoho Cliq channel plugin that uses expected webhook, OAuth, and message-control access for its stated purpose.

Before installing, configure a strong webhookSecret, keep clientSecret and refreshToken in SecretRefs or environment variables, avoid dmPolicy open or wildcard allowFrom unless the workspace is fully trusted, and use group/tool policies to limit who can make the agent read, edit, delete, or react to Cliq messages.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/setup-wizard.js:9
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/account-inspect.test.ts:86
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/client-logging.test.ts:38
Evidence: const oauthBody = opts.oauthBody ?? { access_token: "[REDACTED]", expires_in: 3600 };

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-contract.test.ts:109
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-resolve.test.ts:24
Evidence: const cfg = cfgWith({ clientSecret: "[REDACTED]" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.ts:26
Evidence: clientSecret: "[REDACTED]",