T09 · Insecure Skill Coding Practices
Warning
- Location
random-sticker.sh:18- Finding
jq Expression Injection Through User-Controlled Sticker Tags
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Stickers
Security checks for vulnerabilities and agentic risk
Overview
This Telegram sticker skill is mostly purpose-aligned, but it needs review because it under-discloses bot-token access and has inconsistent, incomplete documentation.
Review before installing. Only run the import script if you are comfortable with it reading your OpenClaw Telegram bot token and contacting Telegram. Treat sticker tags as trusted input, keep stickers.json free of sensitive conversation text, and expect some advertised features to require manual agent logic or missing files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
import-sticker-pack.sh:13- Finding
Telegram Bot Token Exposed in Process Command-Line Arguments
- Content
View full analysis
" echo "" echo "Example:" echo " $0 p_8RnHygLOjgFhGENFwoc1_by_SigStick11Bot" echo "" echo "To find pack name: right-click a sticker in Telegram → Copy Link" echo "The URL will be: https://t.me/addstickers/" exit 1 fi PACK_NAME="$1" echo "🔍 Fetching sticker pack: $PACK_NAME" # Get sticker set from Telegram API RESPONSE=$(curl -s "https://api.telegram.org/bot$BOT_TOKEN/getStickerSet?name=$PACK_NAME") ``` ### Technical Analysis The script legitimately requires a Telegram bot token to call `getStickerSet`, and the reviewed request is sent over HTTPS to Telegram's official API endpoint. Therefore, the network transmission itself is necessary for the declared sticker-pack import feature and is not evidence of transmission to an unauthorized third party. However, the token is embedded in the URL passed as a command-line argument to `curl`. While the request is running, the complete URL may be visible through process-inspection tools or captured by process-accounting, diagnostic, tracing, or monitoring systems. Telegram Bot API tokens authorize actions as the associated bot and must be treated as credentials. The script also does not reject a missing token represented by jq as the literal value `null`. ### Attack Path 1. A user starts a sticker-pack import. 2. The script reads the bot token from `~/.openclaw/openclaw.json`. 3. The script starts `curl` with the token embedded in its URL argument. 4. A local principal or monitoring system capable of observing process arguments captures the URL while the request is active. 5. The observer extracts the token and invokes Telegram ...[truncated 781 chars]- Remediation
View remediation
0)' \ "$HOME/.openclaw/openclaw.json") || { echo "Error: a valid Telegram bot token is not configured" >&2 exit 1 } ``` 5. Ensure application logs, shell tracing, crash reports, and monitoring systems redact Telegram Bot API token paths. 6. Rotate the Telegram bot token immediately if process logs or monitoring records may already contain it. 7. Document that importing packs requires access to the configured Telegram credential and limit execution to trusted local users. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a broader Telegram sticker assistant with collection, pack import, contextual selection, and message frequency controls. The actual code only performs one narrow subset: auto-tagging entries in a local stickers.json file according to emoji mappings. It does not interact with Telegram, send stickers, import packs, choose stickers based on conversation context, or enforce any messaging limits. Because the implemented behavior is materially narrower and lacks several core declared capabilities, this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises an active Telegram sticker management and sending capability with smart selection, auto-import, emotion tagging, and rate/frequency controls. The actual code chunk is a local diagnostic/status script. It reads a local JSON file, counts entries, prints a preview and stats, and provides setup instructions if the file is missing or empty. It does not interact with Telegram, send stickers, import packs, choose stickers contextually, or enforce message frequency limits. This is a materially different primary purpose from the declared behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code only implements one part of the description: importing a sticker pack into a local collection. It fetches a sticker set from Telegram, checks for duplicates, and stores sticker metadata in stickers.json. It does not send stickers, select them contextually, apply emotion-tagging logic, or enforce any frequency/message limits. Additionally, it accesses a Telegram bot token from local config and calls the Telegram API, which is a resource access not reflected in the declared permissions. This is a material mismatch because the declared purpose describes a broader smart sticker agent, while the actual code is just an import utility.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a broader end-to-end Telegram sticker management and sending skill, including collection/import, tagging, contextual choice, and rate limiting. The supplied code chunk is much narrower: it only selects a random sticker from a local JSON dataset based on user-supplied tags and outputs the sticker's file_id. While this partially overlaps with 'select contextually' in a limited tag-filtering sense, the main described capabilities—importing packs, tagging by emotion, sending stickers, and respecting frequency limits—are absent. Therefore the description materially overstates what this code actually does.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Usage Philosophy **Use stickers like humans do:** - Greetings (goodnight/morning) → always prefer sticker over text - Celebrations, humor, empathy → great use cases - Technical answers, reports → skip stickers - Frequency: ~1 per 2-5 messages (track yourself in agent logic)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill will 'Auto-import packs' and implies automated sticker collection/tagging, but these release notes show auto-collection, tag-based filtering, and integration are still roadmap items. The documented implemented features appear narrower than the manifest's claimed scope, indicating a semantic mismatch between stated skill behavior and actual delivered functionality.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill invokes shell scripts and instructs local file modification, but declares no explicit tool scope or permissions. That creates a least-privilege gap: an agent or reviewer cannot reliably tell what capabilities the skill requires, increasing the chance of unintended shell execution or file writes in environments that auto-wire tool access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill proposes storing usage analytics and conversation context in local data without notice, minimization, or retention guidance. That can create privacy and compliance risks because conversational context may include sensitive personal data that is unnecessary for sticker selection and could be exposed through local file access or backups.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Sticker Usage When to send: - Goodnight/morning greetings (always use sticker over text) - Celebrating success/milestones - Humorous moments - Emotional responses (joy, sympathy, encouragement)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes collecting and sending Telegram stickers, and importing packs is consistent with contacting Telegram's API. However, this script specifically reads a bot token from ~/.openclaw/openclaw.json, which adds local credential/config access beyond the core sticker-management behavior described in the manifest.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell script accesses a credential-like value from ~/.openclaw/openclaw.json and uses it for an external API request. Although the script logs the fetch action later, there is no visible notice that it will read a bot token from local configuration, and no explanatory comment or prompt directed to the user about that sensitive access.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "🔍 Fetching sticker pack: $PACK_NAME" # Get sticker set from Telegram API RESPONSE=$(curl -s "https://api.telegram.org/bot$BOT_TOKEN/getStickerSet?name=$PACK_NAME") # Check if successful if ! echo "$RESPONSE" | jq -e '.ok' > /dev/null; then
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill manifest says frequency limits are '2-5 messages', while the release notes state '1 per 5-10 messages'. This is an active contradiction in documentation about a core behavior of the skill, which can mislead users about how often stickers may be sent.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file explicitly advertises direct
sendStickerAPI calls, which are network actions affecting external messaging state. The release notes and quick test instructions present the behavior without any user-facing warning about sending content to Telegram or the operational/privacy implications.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The markdown explicitly tells the agent or operator to update stickers.json manually to track usage, and later shows a command sequence that rewrites the file. There is no accompanying warning that the skill modifies local state or guidance about backups/integrity of that data file.
- Content
Static analysis
No suspicious patterns detected.