T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tgcm.py:57- Finding
Path Traversal Through Unvalidated Channel Names
- Content
View full analysis
- Remediation
View remediation
Security audit
TG Channel Manager
Security checks for vulnerabilities and agentic risk
Overview
This Telegram channel automation skill is mostly coherent, but it handles powerful bot credentials and installation steps in ways users should review carefully before installing.
Install only if you are comfortable with an agent managing Telegram channel configuration, storing or discovering a bot token, creating cron jobs, and potentially posting approved pending content to a live channel. Prefer environment or secret-manager tokens, avoid config list/get for secrets, review cron prompts before enabling them, and do not run the SearXNG installer on a production host without pinning and isolating it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tgcm.py:384- Finding
Telegram Bot Token Stored and Printed in Plaintext
- Content
View full analysis
", file=sys.stderr) return 1 cfg = load_local_config(workspace) cfg[json_key] = value save_local_config(workspace, cfg) print(f"[ok] {key} saved to tgcm/.config.json") return 0 ``` The Skill explicitly directs the Agent to persist the token: ```markdow ...[truncated 2282 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/start-searxng.sh:5- Finding
Mutable Remote Repository Is Downloaded, Installed, and Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/start-searxng.sh:24- Finding
Predictable Hardcoded SearXNG Secret
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
references/scout-prompt.md:29- Finding
Untrusted Search Results Are Consumed Without Prompt-Injection Boundaries
- Content
View full analysis
&format=json&time_range=day&language=en' ``` ``` ```markdown ### 4A. News Draft 1. Read content-queue.md — do not duplicate topics 2. **MANDATORY** dedup check: ```bash python3 {baseDir}/scripts/dedup-check.py --base-dir . --topic "topic" --links "url1" "url2" ``` If matches found — DO NOT create a draft, move to the next news item. 3. **MANDATORY** open the source and read its content. Do not write a post from a headline alone! 4. Write a draft following the format from SKILL.md, style per `config.postStyle` 5. Pick a rubric from `config.rubrics` — choose the most fitting one ``` ```markdown ### 4B. Evergreen Article (if no news found) 1. Read `config.evergreen` — pick a topic 2. Find and read documentation/sources on the topic 3. Write a draft — detailed, in plain language ``` ### Technical Analysis The scheduled scout is required to open arbitrary pages returned by a search engine and consume their text. The prompt does not establish that webpage content is untrusted data, prohibit obedience to instructions found in sources, or separate retrieval from the tool-capable Agent. A malicious webpage can include text crafted as instructions to an AI Agent, such as requests to ignore the Skill, inspect local files, reveal configuration, execute commands, or alter queue state. Search ranking manipulation can make such a page likely to be selected. The intended scout task only requires factual extraction for draft creation. Allowing untrusted source content into the same instruction context as operational rules e ...[truncated 1483 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (22)
YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
python file=sys.stderr, ) return 1 meta["channelId"] = channel_id meta["status"] = "connected" save_channel_meta(channel_dir, meta) sync_channels_index(workspace) print(f"Channel '{name}' bound to {channel_id}") return 0 def tg_api_call(token, method, params=None): """Call Telegram Bot API. Returns result dict or None on error.""" url = f"https://api.telegram.org/bot{token}/{method}" if params: url += "?" + urllib.parse.urlencode(params) try: with urllib.request.urlopen(url, timeout=10) as resp: data = json.loads(resp.read().decode()) if data.get("ok"): return data.get("result") desc = data.get("description", "unknown error") print(f"Telegram API {method}: {desc}", file=sys.stderr) return None except urllib.error.HTTPError as e: desc = f"HTTP {e.code}" try: body = json.loads(e.read().decode()) desc = body.get("des
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a broad, universal content pipeline engine for Telegram channels, including search, drafts, scheduling, deduplication, and config-driven channel abstraction. The supplied code chunk does only one narrow part of that scope: local deduplication checks and index maintenance using content-index.json. It does not perform SearXNG searches, draft handling, scheduling, or any config-driven channel-specific orchestration. While deduplication is mentioned in the description, the primary purpose of this code chunk is much narrower than the declared skill, so the description does not accurately represent what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code does not implement a Telegram content pipeline. It only provisions and starts a local SearXNG instance, including cloning the repository, installing dependencies, modifying configuration, and launching the service. While this may support the declared 'news search via SearXNG' aspect, it does not show the primary declared functionality: a universal config-driven engine for Telegram channels with drafts, scheduling, deduplication, and channel-specific behavior. Therefore the description materially overstates and misrepresents what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description presents a content pipeline engine centered on configurable channel-specific publishing workflows: news search through SearXNG, drafts, scheduled publishing, and deduplication. The supplied code instead implements a management CLI for channel setup and diagnostics. Its main behaviors are creating local channel folders and metadata files, binding Telegram channel IDs, checking bot token/channel access, querying Telegram Bot API for channel details and admins, resolving IDs, and handling a connect event by outputting a DM instruction payload. It also fetches existing posts from public Telegram channels by scraping t.me/s pages and stores lightweight dedup index entries. While there is some overlap with deduplication support and config handling, the primary purpose is materially different, and several declared core capabilities are absent: there is no scheduled publishing, no actual search against SearXNG, and no end-to-end draft/publishing pipeline. Additionally, the code performs undeclared Telegram introspection and scraping capabilities not reflected in the description.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python def rebuild_index_instructions(channel_id): """Print instructions for rebuilding the index via Telegram search API.""" print("📋 Index rebuild via Telegram search API:") print() print("The agent should perform the following steps:")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to use command execution, read/write local files, access environment variables, and perform network operations, yet it declares no tool scope or permission boundaries. This increases the risk of over-privileged execution because the runtime and reviewer cannot easily constrain what the skill may do.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The instruction to run commands autonomously and 'act on results, don't ask' reduces user confirmation before state-changing actions such as config writes or channel binding steps. In a skill that can execute commands, modify files, and use network resources, minimizing confirmation can lead to unintended changes and makes prompt-instruction abuse more dangerous.
- Content
md ## Execution `python3` and `curl` are available in your environment (declared in `requires.bins`). Run all commands yourself using `exec`/`bash` tool. NEVER ask the user to run commands for you. ## Startup
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The startup flow tells the agent to ask for and save credentials or env-like settings, while a later section says not to ask for bot tokens or env vars. Contradictory instructions around secret acquisition and handling can cause unsafe agent behavior, including prompting for sensitive data when it should rely on existing resolution paths or provide safer guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs storing a Telegram bot token locally in tgcm/.config.json without clearly warning the user that this is a persistent credential write. A bot token grants control over the bot and possibly channel-management operations, so accidental storage in a shared workspace, insecure repo, or readable filesystem can lead to account compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation describes setting up unattended publishing jobs that post directly to a live Telegram channel, but it does not warn users that these commands automate public-facing publication. In a content pipeline skill, this omission increases the chance of accidental live posts, misuse of drafts, or publication of unreviewed/generated content, especially when cron jobs are configured from reusable templates.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The prompt is framed as a generic 'Cron: Publisher' workflow and directly instructs the agent to publish to a live Telegram channel, but it does not define strong activation boundaries, confirmation requirements, or environmental safeguards. In an agent system where prompts may be invoked broadly or misrouted, this ambiguity can cause unintended publication actions against production channels without explicit human approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to remove the published entry from content-queue.md is a destructive state change, yet the prompt provides no warning, backup, audit trail, or transactional safeguard around that deletion. If publication fails partially, targets the wrong post, or the agent misidentifies state, queued content can be silently lost or corrupted, making recovery and forensic review difficult.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes the skill's task and behavior but does not define any specific invocation phrases, scope boundaries, or negative examples for activation. Phrases like 'Find fresh news and write drafts' are operationally broad, which can lead to unintended invocation if used as the basis for routing or activation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to modify repository content by appending drafts to content-queue.md, but it provides no user-facing warning or approval checkpoint before making persistent changes. In agentic environments, silent file mutation can lead to unauthorized repository edits, workflow poisoning, or accidental propagation of low-quality or adversarial content into downstream publishing systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt directs the agent to perform external network requests with curl to a configurable SearXNG endpoint, without any warning, allowlist, or consent boundary. This can expose the environment to SSRF-like behavior if SEARXNG_URL is attacker-controlled, leak metadata through outbound requests, or retrieve untrusted content that influences subsequent repository writes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as a config-driven Telegram channel content pipeline, but this CLI also searches the current directory and the user's home directory for an external openclaw.json file to extract credentials. Pulling secrets from unrelated global config locations is not an obvious requirement for managing Telegram channels and expands the skill's access to ambient credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def tg_api_call(token, method, params=None): """Call Telegram Bot API. Returns result dict or None on error.""" url = f"https://api.telegram.org/bot{token}/{method}" if params: url += "?" + urllib.parse.urlencode(params) try:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The config command stores sensitive bot tokens in plaintext in tgcm/.config.json and the list action prints all saved values, which can expose credentials to local users, shell history capture, logs, screenshots, or CI output. Credential disclosure would let anyone with the token control the Telegram bot and act against connected channels.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The Quick Reference maps user requests using Russian phrases such as
«узнай/определи channel-id»and«подключи канал», which suggests a language-specific interaction pattern. The file does not explicitly offer multilingual support or justify that the skill is intended only for Russian-speaking users.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The curl example hard-codes 'language=en' for search, which imposes a specific language/locale behavior. The file does not indicate that this is optional, user-configurable, or justified as a region-specific requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The rule 'Post language: config.language' indicates the skill will enforce a specific output language, but this file does not mention user choice, opt-in, or a justified regional constraint. That can violate language/locale policy when users are not given a choice.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest focuses on news search, drafts, scheduled publishing, and deduplication for Telegram channels. The --admins and detailed --permissions capabilities inspect channel administrators and privilege metadata, which are management/introspection features not clearly justified by the stated content pipeline scope.
- Content