Claude Code Changelog Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:48 AM UTC
• Version: 1.0.0

Overview

The skill is a release monitor, but it ships a built-in Telegram bot token and fixed chat destination that can be used automatically instead of the user's own Telegram setup.

Review before installing. Do not run the setup as-is unless you are comfortable with a built-in Telegram bot token and chat ID being used when your own credentials are absent. A safer version should remove the embedded token and chat ID, require explicit user-provided Telegram settings, confirm the destination before any test or first run, protect any credential file permissions, and either remove package extraction or validate tarballs before extracting them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/monitor.sh:10

Finding

Hard-Coded Telegram Bot Credential and Fixed External Recipient

Content

View full analysis

/dev/null 2>&1 && log_info "Alert sent!" || log_error "Failed to send alert" ``` The setup script also runs the monitor immediately: ```bash # Run once to initialize echo "" echo "🚀 Running initial check..." bash ~/clawd/skills/cc-changelog-monitor/scripts/monitor.sh ``` ### Technical Analysis The monitor includes a Telegram bot token and group or chat identifier directly in source code. Environment variables can override these values, but the embedded credentials are used automatically when the variables are absent. Consequently, a default installation does not fail safely when the user has not supplied their own Telegram configuration. The bot token is an authentication secret. Anyone with access to this package can obtain it and attempt to invoke Telegram Bot API operations permitted to that bot. The fixed chat ID also causes release notifications to be sent to a preconfigured external recipient without an explicit destination confirmation during setup. This implementation conflicts with the documentation, which states that setup detects a local token, asks for a chat ID, and stores configuration in `~/.cc-changelog-config`. The actual `setup.sh` performs none of those actions and instead immediately executes the monitor. The message contains release and local ...[truncated 1608 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/monitor.sh:43

Finding

Unvalidated Remote Tarball Download and Extraction

Content

View full analysis

/dev/null) PUBLISHED=$(echo "$VERSION_INFO" | jq -r '.time.published' 2>/dev/null | cut -d'T' -f1) tarball=$(echo "$VERSION_INFO" | jq -r '.dist.tarball' 2>/dev/null) ``` The supplied archive is then downloaded and extracted without integrity or entry validation: ```bash # 9. Optionally download and extract for future diffs if [ ! -d "$OUTDIR/$LATEST" ]; then log_info "Downloading package for future diffs..." mkdir -p "$OUTDIR/$LATEST" TMP_TARBALL="/tmp/claude-code-${LATEST}.tgz" curl -sL "$tarball" -o "$TMP_TARBALL" 2>/dev/null && \ tar -xzf "$TMP_TARBALL" -C "$OUTDIR/$LATEST" 2>/dev/null && \ rm -f "$TMP_TARBALL" && \ log_info "Package extracted to $OUTDIR/$LATEST" || \ log_warn "Failed to extract package (non-critical)" fi ``` ### Technical Analysis The tarball URL and archive contents are controlled by npm registry metadata for the monitored package. The script follows redirects and extracts the resulting archive without: - Restricting the final download destination to an approved HTTPS npm host. - Verifying the package’s npm integrity or checksum metadata. - Checking archive entries for absolute paths or `..` traversal components. - Rejecting symbolic links, hard links, device nodes, or other special entries. - Using a securely created, private temporary directory. The extracted package is not executed by this Skill, which limits direct code-execution risk. However, archive extraction can still have filesystem effects. Depending on the archive contents and local `tar` behavior, malicious paths or links could cause fil ...[truncated 1898 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

- Auto-detect your Telegram bot token from OpenClaw config (if available)
- Ask for your Telegram chat ID
- Initialize the version tracker at the current Claude Code version
- Print instructions for adding the cron job

**3. Add the cron in OpenClaw:**

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior does not fully match the reported capabilities: embedded default Telegram credentials, extra external access, and persistent downloading/extraction all expand the skill's authority beyond simple release monitoring. Hidden credentials or undisclosed outbound communication are especially dangerous because they can lead to secret misuse, unexpected data exfiltration, or execution of broader actions than the user consented to.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A Telegram bot token is hardcoded directly into the script, which is a clear credential exposure. Anyone with access to the file or repository can reuse the token to send messages, impersonate the bot, or abuse the associated Telegram integration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md

## Prerequisites

- [OpenClaw](https://openclaw.ai) installed (for cron scheduling)
- A Telegram bot token (create one via [@BotFather](https://t.me/BotFather))
- `curl`, `jq`, `npm` installed on your machine

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises shell-driven behavior but does not declare any explicit tool scope or permissions, which weakens the trust boundary and makes it easier for a caller to invoke network and filesystem operations without clear user awareness. In a skill that polls npm, writes files under the home directory, and sends Telegram messages, missing tool declarations meaningfully reduce transparency and reviewability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill sends release and diff information to Telegram using stored bot credentials but does not clearly warn users that data will be transmitted to a third-party messaging platform. Even if the payload seems low sensitivity, changelog diffs, environment-linked metadata, or future modifications could leak information outside the local system without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to schedule a recurring script that will send Telegram alerts, which implies outbound network activity from a background task. While the behavior appears aligned with the skill’s stated purpose, the instructions do not give a clear upfront warning about the recurring external communications, reducing informed consent and making persistent data egress easier to overlook.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · cron-payload.md (reported line 38)May include surrounding context.

Option 3: Native macOS cron (fallback, no OpenClaw required)

bash

crontab -e

Add this line:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/monitor.sh (reported line 62)May include surrounding context.

sh

# 6. Try to get release notes from GitHub (if available)
RELEASE_NOTES=""
if command -v curl &> /dev/null; then
    GITHUB_JSON=$(curl -s "https://api.github.com/repos/anthropics/claude-code/releases/tags/v${LATEST}" 2>/dev/null || echo "{}")
    BODY=$(echo "$GITHUB_JSON" | jq -r '.body[0:500]' 2>/dev/null || echo "")
    if [ -n "$BODY" ] && [ "$BODY" != "null" ]; then
        RELEASE_NOTES="

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/monitor.sh (reported line 82)May include surrounding context.

sh

_Monitored by OpenClaw_"

log_info "Sending Telegram alert..."
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
    -H "Content-Type: application/json" \
    -d "{
        \"chat_id\": \"${TELEGRAM_CHAT_ID}\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/monitor.sh (reported line 82)May include surrounding context.

sh

_Monitored by OpenClaw_"

log_info "Sending Telegram alert..."
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
    -H "Content-Type: application/json" \
    -d "{
        \"chat_id\": \"${TELEGRAM_CHAT_ID}\",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as a changelog/version monitor, but it also downloads and extracts remote package tarballs to the local filesystem. That behavior expands the script's trust boundary and persistence footprint beyond alerting, creating unnecessary supply-chain and local file modification risk if the tarball is malicious or unexpectedly large.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The archival and extraction capability is not necessary for the stated purpose of monitoring releases and sending alerts. Unjustified package retrieval from a remote source increases attack surface, can consume disk space, and may expose the host to malicious archive contents or unsafe extraction side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script silently downloads and extracts a remote tarball into the user's home directory without explicit notice or consent at runtime. Even though it comes from npm metadata, this still performs non-obvious filesystem modification and introduces supply-chain risk inconsistent with the simple monitoring use case.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 8)May include surrounding context.

sh

echo "🔧 Setting up cc-changelog-monitor..."

# Create directories
mkdir -p ~/clawd/projects/cc-changelog
mkdir -p ~/clawd/skills/cc-changelog-monitor/scripts

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README instructs users to store a Telegram bot token and chat ID in a plaintext file under the home directory, but does not warn that the token is a secret or recommend restrictive file permissions. If the workstation is shared, backed up insecurely, or other local processes can read dotfiles, the bot token could be stolen and abused to send messages or access bot-related data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.