openclaw-cliq-integration
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include the installation of an external plugin using the command
openclaw plugins install clawhub:@sprintcx/openclaw-cliq. This package is the core component for the Zoho Cliq integration. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an integration pathway where external data from Zoho Cliq is ingested into the agent context, creating a potential surface for indirect prompt injection.
- Ingestion points: Inbound webhook events containing user message text, file attachments, and interactive form submissions.
- Boundary markers: None explicitly defined in the setup instructions for prompt separation or delimiting untrusted input.
- Capability inventory: The plugin is capable of sending, editing, and deleting messages, creating interactive cards, and downloading file attachments via the Zoho Cliq API.
- Sanitization: The skill documents robust webhook validation (using
x-cliq-webhook-secretwith constant-time comparison) and bot loop protection, though it does not specify prompt-level sanitization for the ingested message content.
Audit Metadata