Security audit

Telegram Ops

Security checks across malware telemetry and agentic risk

Overview

The skill performs legitimate Telegram forum management, but it also gives broad persistent OpenClaw configuration authority and leaves new topics with all skills available by default.

Install only if you are comfortable letting this skill manage Telegram forum topics and edit OpenClaw Telegram configuration. Use a minimally privileged bot token, avoid exposing the token in logs or chats, review every config.patch payload before applying it, and add an explicit skills allowlist for each topic instead of relying on the all-skills default.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill provides shell commands and operational procedures but does not declare corresponding permissions, which can mislead operators and policy enforcement about its actual capabilities. In this context, the undocumented shell access is meaningful because the instructions include config reads, config mutation, session export, and deletion workflows.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly advises omitting the `skills` key so that all skills remain available to the topic, which violates least privilege and can grant unrelated capabilities far beyond Telegram forum management. If a topic is later used by an agent handling untrusted content, this broad skill exposure increases the blast radius of prompt injection or operator error.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill scope extends beyond Telegram Bot API actions into OpenClaw configuration changes, agent system prompt setup, session export, and session deletion. This scope creep makes the skill more dangerous because a user invoking a seemingly narrow Telegram-management skill is also being guided to alter core agent behavior and persistence state.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions tell operators how to retrieve a bot token from configuration and use it in API calls without any warning about credential sensitivity, masking, storage, or logging risk. In practice, this can lead to accidental exposure in shell history, transcripts, screenshots, or copied commands, enabling takeover of the Telegram bot.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The archiving workflow includes deleting session state and transcripts with only a brief note, but no prominent warning that the action may be irreversible or operationally sensitive. Because these sessions contain conversation history and context, accidental deletion can cause data loss, audit gaps, and disruption to future incident review or continuity.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:56