T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_topic.sh:2- Finding
Telegram Bot Token Exposed Through Process Arguments and Request URLs
- Content
View full analysis
[emoji_id] set -e TOKEN="$1" CHAT_ID="$2" NAME="$3" EMOJI_ID="$4" ``` ```bash RESPONSE=$(curl -s -X POST "https://api.telegram.org/bot${TOKEN}/createForumTopic" \ -H "Content-Type: application/json" \ -d "{ ``` ```bash EDIT_RESPONSE=$(curl -s -X POST "https://api.telegram.org/bot${TOKEN}/editForumTopic" \ -H "Content-Type: application/json" \ -d "{ ``` `scripts/archive_topic.sh:7-14, 32-34, 52-54`: ```bash # Usage: ./archive_topic.sh set -e TOKEN="$1" CHAT_ID="$2" TOPIC_ID="$3" CURRENT_NAME="$4" ``` ```bash EDIT_RESPONSE=$(curl -s -X POST "https://api.telegram.org/bot${TOKEN}/editForumTopic" \ -H "Content-Type: application/json" \ -d "{ ``` ```bash CLOSE_RESPONSE=$(curl -s -X POST "https://api.telegram.org/bot${TOKEN}/closeForumTopic" \ -H "Content-Type: application/json" \ -d "{ ``` `SKILL.md:12-16`: ```bash - Get the bot token from OpenClaw config: ```bash gateway action=config.get | jq -r '.result.parsed.channels.telegram.botToken' ``` ``` ### Technical Analysis Both scripts require the Telegram bot token as the first command-line argument. Command-line arguments can be retained in shell history and may be visible through process inspection, audit systems, debugging output, terminal recording, or command telemetry. The token is subsequently embedded directly in the Telegram API URL passed to `curl`. As a result, the token can also appear in the `curl` process argument list and in diagnostic or URL-level logging. Although sending the token to the officia ...[truncated 1697 chars]- Remediation
View remediation