Security audit

CreateTelegramClawAgent

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it unnecessarily asks the agent to show a full Telegram bot token in chat, which can expose a credential.

Review before installing. Use this only if you are comfortable configuring a Telegram bot through OpenClaw, and avoid pasting bot tokens into ordinary chat where possible. If you proceed, mask the token in previews and summaries, store it through a secret mechanism if OpenClaw supports one, and revoke/regenerate the token through BotFather if it has already been exposed in chat logs or screenshots.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:118
Finding: Full Telegram Bot Token Is Collected and Reproduced in Conversation Output
Content: View full analysis
": { "enabled": true, "dmPolicy": "pairing", "botToken": "", "groupPolicy": "allowlist", "streamMode": "partial" } ``` Lines 118–127 explicitly require the full token to be reproduced during the configuration review: ```markdown ### 3. Telegram Bot Account (add to channels.telegram.accounts) ```json "": { "enabled": true, "dmPolicy": "pairing", "botToken": "", "groupPolicy": "allowlist", "streamMode": "partial" } ``` ``` ### Technical Analysis A Telegram bot token is a bearer credential: anyone who obtains it can authenticate to the Telegram Bot API as the associated bot. The skill requires the user to submit this credential through the conversation and then directs the agent to display the complete token in a configuration summary. Reproducing the full token is unnecessary for review and increases the number of locations in which the credential may persist. Depending on the surrounding platform, copies could remain in conversation history, model context, operational telemetry, debugging output, screenshots, exports, or other logs. Although the skill warns users to keep tokens secure, its workflow contradicts that warning by handling and displaying the token in plaintext. The token must ultimately be made available securely to the relevant service, but it does not need to be echoed in agent responses or embedded visibly in a review message. ### Attack Path 1. A user invokes the skill to create ...[truncated 1799 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
- Add binding to `bindings` - Add bot account to `channels.telegram.accounts` 3. **Create agent files:** - `AGENTS.md` - Work responsibilities and workflow - `SOUL.md` - Agent personality and values

Static analysis

No suspicious patterns detected.