Openclaw Zulip Bridge

💬 High-performance Zulip bridge skill. Enables messaging, stream monitoring, and administrative actions on Zulip servers.

This package appears to be a genuine Zulip channel plugin, but the registry listing and the repo disagree about how it is delivered and what it requires. Before installing or supplying secrets: 1) Confirm the publisher identity and source (the 'Source' and 'Homepage' are listed as unknown/none). 2) Prefer using environment variables (ZULIP_API_KEY, ZULIP_EMAIL, ZULIP_URL) rather than storing credentials in openclaw.json; the code explicitly warns about plaintext storage. 3) Verify how the plugin will be installed (ClawHub vs local link). If installing from this bundle, inspect the built artifacts (dist/) that will be installed — the package expects built files that are not shown in the top-level registry metadata. 4) If you need stronger assurance, ask the publisher for a canonical repo or release (e.g., GitHub release) and/or request a signed release or checksum. Because of the metadata vs source mismatch, treat this skill as suspicious until you confirm its provenance and how credentials will be handled.

Type: OpenClaw Skill Name: zulip-bridge Version: 2026.4.13 The Zulip bridge skill is a well-engineered integration for the Zulip communication platform, demonstrating significant attention to security best practices. Key security controls include SSRF protection in `src/zulip/client.ts` by restricting protocols to HTTP/HTTPS, path traversal prevention in `src/zulip/uploads.ts` via basename sanitization, and explicit hardening against local file exfiltration in `src/zulip/send.ts` by rejecting non-HTTP media URLs. The codebase includes a robust test suite (e.g., `test/send-security.test.ts`, `test/path-traversal.test.ts`) specifically designed to verify these security boundaries. No evidence of malicious intent, data exfiltration, or unauthorized persistence was found.