T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:118
- Finding
- Full Telegram Bot Token Is Collected and Reproduced in Conversation Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32–34, 76–82, and 118–127 **Vulnerability Type**: Plaintext sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code Snippets Lines 32–34 instruct the user to provide the complete credential: ```markdown 3. **Telegram Bot Token** (required) - Format: `1234567890:ABCdefGHIjklMNOpqrSTUvwxyz` - Get from @BotFather on Telegram ``` Lines 76–82 place the complete token in generated configuration: ```json "<bot-id>": { "enabled": true, "dmPolicy": "pairing", "botToken": "<full-bot-token>", "groupPolicy": "allowlist", "streamMode": "partial" } ``` Lines 118–127 explicitly require the full token to be reproduced during the configuration review: ```markdown ### 3. Telegram Bot Account (add to channels.telegram.accounts) ```json "<bot-id>": { "enabled": true, "dmPolicy": "pairing", "botToken": "<full-bot-token>", "groupPolicy": "allowlist", "streamMode": "partial" } ``` ``` ### Technical Analysis A Telegram bot token is a bearer credential: anyone who obtains it can authenticate to the Telegram Bot API as the associated bot. The skill requires the user to submit this credential through the conversation and then directs the agent to display the complete token in a configuration summary. Reproducing the full token is unnecessary for review and increases the number of locations in which the credential may persist. Depending on the surrounding platform, copies could remain in conversation history, model context, operational telemetry, debugging output, screenshots, exports, or other logs. Although the skill warns users to keep tokens secure, its workflow contradicts that warning by handling and displaying the token in plaintext. The token must ultimately be made available securely to the relevant service, but it does not need to be echoed in agent responses or embedded visibly in a review message. ### Attack Path 1. A user invokes the skill to create ...[truncated 1799 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not reproduce the complete token** - Mask it in all configuration previews, for example: ```text 1234567890:****************wxyz ``` - Display only enough characters to let the user distinguish among credentials. 2. **Use a protected secret-input channel** - Prefer a platform-provided secret prompt, credential manager, or secure environment-variable mechanism instead of ordinary conversational input. - Avoid retaining the raw token in chat history or persistent agent memory. 3. **Separate review from secret injection** - Present configuration using a placeholder such as: ```json "botToken": "${TELEGRAM_BOT_TOKEN}" ``` - After confirmation, obtain and inject the token through the protected secret channel without echoing it. 4. **Protect configuration at rest** - If `openclaw.json` must contain the token, restrict its filesystem permissions to the owning user. - Prefer a dedicated secret store or a reference to a protected environment variable when supported. 5. **Prevent accidental disclosure** - Redact known Telegram token patterns from logs, diagnostics, command output, error messages, and completion summaries. - Do not include the token in generated `AGENTS.md`, `SOUL.md`, or other workspace files. 6. **Add credential lifecycle guidance** - Tell users to revoke and regenerate the token through BotFather if it has appeared in conversation history, logs, screenshots, or other unauthorized locations. - Ensure replaced tokens are removed from all configuration and secret-storage locations. 7. **Retain the existing confirmation control** - Continue requiring explicit user confirmation before changing `openclaw.json`, but ensure the confirmation preview contains only a masked token or secret reference. ]]>