Security audit

Zoho Cliq

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Zoho Cliq channel plugin for OpenClaw with broad but purpose-aligned messaging, webhook, OAuth, and setup capabilities.

Install only if you intend to expose an OpenClaw agent in Zoho Cliq. Prefer the runtime-only OAuth profile unless you need setup to create or update Cliq bots and handlers, keep DM access allowlisted or pairing-based, set session.dmScope to per-channel-peer for multi-user bots, store secrets as SecretRefs/environment variables, and rotate the webhook secret when bot editor or Bots.READ access changes.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/src/oauth-exchange-command.js:94
Evidence: const code = options.code?.trim() || stringValue(process.env[CLIQ_AUTH_CODE_ENV]);

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/oauth-exchange-command.ts:137
Evidence: const code = options.code?.trim() || stringValue(process.env[CLIQ_AUTH_CODE_ENV]);

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/provision-command.js:17
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/setup-wizard.js:73
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/account-inspect.test.ts:106
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/capabilities.test.ts:428
Evidence: Authorization: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/client-logging.test.ts:38
Evidence: const oauthBody = opts.oauthBody ?? { access_token: "[REDACTED]", expires_in: 3600 };

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/config-validation.test.ts:103
Evidence: { ...BASE, clientSecret: "[REDACTED]", webhookSecret: "wh" },

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/doctor-runner.test.ts:19
Evidence: const CLIENT_SECRET = "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/handler-secret-exposure.test.ts:98
Evidence: const clientSecret = "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/oauth-exchange-command.test.ts:107
Evidence: JSON.stringify({ access_token: "[REDACTED]", scope: FULL_SCOPE_STRING }),

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/provision-command.test.ts:92
Evidence: CLIQ_CLIENT_SECRET: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/provision-command.ts:52
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-contract.test.ts:125
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/secret-resolve.test.ts:27
Evidence: const cfg = cfgWith({ clientSecret: "[REDACTED]" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/security-audit.test.ts:319
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.test.ts:860
Evidence: clientSecret: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/setup-wizard.ts:120
Evidence: clientSecret: "[REDACTED]",