Zendesk

Manage Zendesk tickets, users, and support workflows with API integration and automation.

This skill appears to be what it says: it will use your Zendesk API token/email/subdomain to call Zendesk endpoints and may save credentials to ~/zendesk/memory.md. Before installing or using it: (1) prefer setting credentials as environment variables rather than pasting them in chat; (2) if you must store credentials on disk, restrict permissions on ~/zendesk/ (chmod 700) and avoid committing that folder to version control; (3) use a least-privileged API token/account for automation and rotate the token if it is shared; (4) note the documentation uses inconsistent variable names in places—confirm which env var names the agent expects; (5) test with a non-production Zendesk account if possible.

Type: OpenClaw Skill Name: zendesk Version: 1.0.0 The skill's core functionality aligns with its stated purpose of managing Zendesk, with all API calls directed at legitimate Zendesk endpoints. However, it stores sensitive API credentials (Zendesk subdomain, email, and API token) in plain text within `~/zendesk/memory.md`, as explicitly detailed in `SKILL.md`, `memory-template.md`, and `setup.md`. This practice represents a significant vulnerability, as these credentials could be exposed to other local processes or unauthorized users if the file permissions are not strictly enforced. While there is no evidence of intentional malicious activity or exfiltration to unauthorized third parties, this insecure credential storage method makes the skill suspicious due to the high risk of credential compromise.