Security audit

telegram-bot-chat

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because its deployment script can copy every installed skill across all matching OpenClaw workspaces.

Install only after reviewing the deployment commands. If used, copy only the intended telegram-bot-chat skill to explicitly chosen bot workspaces, avoid running broad wildcard scripts as root, and do not send credentials, tokens, internal prompts, or sensitive user data through Telegram groups.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:32
Finding: Overbroad Cross-Agent Skill Replication
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 2. Replace wildcard workspace discovery with an explicit allowlist: ```bash SOURCE_SKILL="/root/.openclaw/workspace/skills/telegram-bot-chat" for workspace_dir in \ "/root/.openclaw/workspace-2" \ "/root/.openclaw/workspace-3" \ "/root/.openclaw/workspace-4" do [ -d "$workspace_dir" ] || continue mkdir -p -- "$workspace_dir/skills" cp -R -- "$SOURCE_SKILL" "$workspace_dir/skills/" done ``` 3. If dynamic workspace discovery is required, canonicalize each destination with `realpath`, verify that it is an approved workspace, reject symbolic links, and enforce an exact naming policy before writing. 4. Correct any main-workspace exclusion by comparing canonical workspace roots rather than comparing a workspace root with its `skills` subdirectory. 5. Run deployment using a dedicated account with write permission only to the approved destination workspaces, rather than using unrestricted root privileges. 6. Validate the selected skill before replication using package signatures, trusted hashes, or an approved manifest. Refuse deployment if additional unapproved files or executable scripts are present. 7. Use `--` before path arguments and quote all expansions to prevent paths from being interpreted as command options or split unexpectedly. 8. Update both duplicated copies of the deployment procedure in `SKILL.md` so that an operator cannot inadvertently follow the unsafe version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes a shell script that bulk-copies all skills into every matching /root/.openclaw/workspace* directory, but it does not warn about its broad filesystem scope, duplicate deployment, or overwrite/collision risks. In a multi-agent environment, this can unintentionally propagate unreviewed skills across multiple bot workspaces and expand the blast radius of any malicious or misconfigured skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs agents to send and relay messages through Telegram group chats and bot accounts without warning that content is leaving the local system and being shared with external recipients. This creates a risk of unintended data exfiltration, disclosure of sensitive prompts or agent outputs, and misuse of bot credentials in a multi-agent coordination context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file consistently uses Chinese for instructions, headings, warnings, and examples, effectively forcing a specific language for all users. There is no opt-in language selection or stated reason that this skill is limited to Chinese-speaking users or a China-specific deployment context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.