ClawHub
Back to skill

Security audit

📤 Telegram File Sender

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can send local files to Telegram with weak confirmation, destination visibility, and cleanup controls.

Review this before installing if your workspace may contain private files. Only use it for explicit file-send requests, verify the exact file and Telegram destination before each send, avoid relying on the documented prefix path check without a safer containment check, and do not let it delete /tmp/ files unless it created them during the same operation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:95
Finding

Workspace Boundary Bypass Through Unsafe String-Prefix Validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:66
Finding

Telegram Bot Token Exposed Through Process Command-Line Arguments

Content
View full analysis
" FILE_PATH="" CAPTION="" curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \ -F chat_id="$CHAT_ID" \ -F document=@"$FILE_PATH" \ -F caption="$CAPTION" ``` The same unsafe URL construction is also used for `sendPhoto` at line 80 and duplicated in the translated example at lines 153-158. ### Technical Analysis The Bot API requires the token in the request URL. Expanding `${BOT_TOKEN}` directly in the `curl` command causes the complete token-bearing URL to become part of curl's process argument vector. Depending on operating-system configuration, process arguments may be visible through process inspection interfaces, diagnostic tools, shell tracing, endpoint monitoring, crash reporting, or command telemetry. The statement that the token is not logged does not prevent these indirect disclosure channels. Possession of the token ordinarily permits authentication as the Telegram bot within the authorization scope assigned to that bot. ### Attack Path 1. The Skill reads `TG_BOT_TOKEN` and interpolates it into the API URL. 2. It launches `curl` with the full token-bearing URL as a command-line argument. 3. A local user, monitoring agent, diagnostic collector, or other process with sufficient visibility captures curl's argument vector while the request is running. 4. The observer extracts the token from the `/bot/...` URL. 5. The token is reused to invoke Telegram Bot API methods as the affected bot. ### Impact Assessment An attacker who obtains the token can impersonate the bot and invoke API operations allowed to it, potentially including sending messages or files, retrieving pending updates, and disrupting legitimate update ...[truncated 195 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:100
Finding

Unscoped Deletion of Files Located Under the Temporary Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text includes a broad catch-all phrase like 'any request to deliver a workspace file via Telegram,' which can cause the skill to activate on loosely related prompts and exfiltrate local files to an external service. In a file-sending skill, overbroad activation materially increases the chance of unintended transmission because the action is inherently high sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description does not prominently warn up front that it will transmit local files outside the workspace to Telegram, a third-party service. Without an explicit disclosure before use, users may not understand that invoking the skill causes external data transfer, increasing the risk of accidental data leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This code path explicitly uploads a local file to Telegram's external API. Even though external transmission is the intended function, it is still a real security-sensitive data exfiltration primitive: if the skill is triggered on the wrong file, wrong chat context, or without sufficiently informed consent, local workspace data can be disclosed externally.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
FILE_PATH="<resolved absolute path>"
CAPTION="<optional description>"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \
  -F chat_id="$CHAT_ID" \
  -F document=@"$FILE_PATH" \
  -F caption="$CAPTION"

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The photo send variant also uploads a local file to Telegram, creating the same outbound exfiltration channel for images and similar media. Images often contain sensitive content or metadata, so direct transmission to an external service remains dangerous even if this is expected behavior.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

For photos:

bash
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendPhoto" \
  -F chat_id="$CHAT_ID" \
  -F photo=@"$FILE_PATH" \
  -F caption="$CAPTION"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The instruction to use chat_id from session context and never prompt the user reduces user visibility into the destination and allows the skill to make a sensitive routing decision implicitly. For an exfiltration-capable skill, hiding or assuming the recipient increases the risk of sending files to the wrong chat or to a destination the user did not intend.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
3. **No content logging:** Do not log file contents or read file contents for any purpose beyond sending.
4. **Size limit:** Enforce 50 MB maximum (Telegram Bot API limit for documents).
5. **User confirmation:** For files > 10 MB, warn the user about size before sending.
6. **Chat ID:** Use the `chat_id` from the session context. Never prompt the user for a chat ID.
7. **Ephemeral files:** If the file is in `/tmp/`, clean up after sending.

## Behavior Rules

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The duplicated document-upload example in the Chinese section confirms the skill's core behavior is external transmission of local files to Telegram. This is a true vulnerability in the sense of a powerful exfiltration capability whose safety depends entirely on strong invocation, consent, and destination controls.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
FILE_PATH="<解析后的绝对路径>"
CAPTION="<可选描述>"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \
  -F chat_id="$CHAT_ID" \
  -F document=@"$FILE_PATH" \
  -F caption="$CAPTION"