Openclaw Telegram Chat

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  0.1.0

Overview

This is a documentation-only Telegram setup guide with expected bot-token and group-permission steps, but users should handle those permissions carefully.

Use a dedicated Telegram bot, keep the bot token private, avoid committing it to repositories, restrict allowed_chats to intended groups, grant only the minimum admin permissions needed, and disable privacy mode only in trusted groups where members understand the bot may see more messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to place a Telegram Bot Token directly into configuration but never warns that the token is a secret credential. In practice, users may paste real tokens into tracked files, screenshots, chat messages, or public repositories, allowing anyone who obtains the token to control the bot and access or impersonate its communications.

VirusTotal

66/66 vendors flagged this skill as clean.