Security audit

Telegram Usage Stats

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to show Telegram usage stats, but it ships under-scoped code that can read local Clawdbot session files and has incomplete disclosure around local state and command use.

Review this before installing if your Clawdbot session files contain sensitive conversations or multiple agents share the same account. The skill does not show evidence of exfiltration or destructive behavior, but it should validate session identifiers, escape Telegram HTML, document any local writes, and tightly limit which session files it can read.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: session-reader.js:16
Finding: Unvalidated Agent and Session Identifiers Permit Filesystem Path Traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: session-reader.js:274
Finding: Unescaped Session Metadata Enables Telegram HTML Injection
Content: View full analysis
📊 Session Usage Report\n\n'; message += '🔋 Quota Remaining\n'; message += `${quotaIndicator} ${stats.quotaRemaining}% of API quota\n`; message += `Provider: ${stats.provider}\n\n`; message += '⏱️ Session Time\n'; message += `${timeRemaining} remaining\n`; message += '(resets daily at 4:00 AM)\n\n'; message += '🎯 Tokens Used\n'; const total = stats.totalTokens.input + stats.totalTokens.output; message += `${total.toLocaleString('en-US')} total tokens\n`; message += `├─ Input: ${stats.totalTokens.input.toLocaleString('en-US')}\n`; message += `└─ Output: ${stats.totalTokens.output.toLocaleString('en-US')}\n\n`; message += '📦 Context Window\n'; message += `${contextIndicator} ${stats.contextPercentage || 0}% used\n`; message += `${stats.contextUsage.used.toLocaleString('en-US')} / ${stats.contextUsage.total.toLocaleString('en-US')} tokens\n`; message += `\nModel: ${stats.model}`; if (stats.sessionId) { message += `\nSession: ${stats.sessionId.substring(0, 8)}...`; } return message; } ``` ### Technical Analysis The report is intentionally constructed as Telegram HTML, but dynamic values such as `stats.provider`, `stats.model`, and `stats.sessionId` are interpolated without HTML escaping. These values originate from the session store: ```js model: session.model, provider: session.provider ``` If session metadata contains `<`, `>`, or `&`, it can alter the message markup or make Te ...[truncated 1352 chars]
Remediation: View remediation
/g, '>'); } ``` Use the encoder consistently: ```js const provider = escapeTelegramHtml(stats.provider); const model = escapeTelegramHtml(stats.model); const sessionId = escapeTelegramHtml(stats.sessionId || ''); message += `Provider: ${provider}\n\n`; message += `\nModel: ${model}`; if (sessionId) { message += `\nSession: ${sessionId.substring(0, 8)}...`; } ``` Additionally: 1. Escape all dynamic string fields, including any fields added in future revisions. 2. Validate model, provider, and session identifiers against expected formats as defense in depth. 3. Prefer plain-text output with Telegram HTML parse mode disabled when rich formatting is unnecessary. 4. Add tests containing `<`, `>`, `&`, nested tags, malformed tags, and Telegram-supported link markup to confirm output cannot alter the intended report structure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is described as merely displaying usage statistics, but the backing behavior reportedly executes an external command and reads/writes local quota-tracking data without declaring those actions. This mismatch is dangerous because it conceals privileged behavior behind a benign description, reducing informed consent and making abuse or accidental data exposure more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill invokes a Node handler and the analysis indicates environment/code capabilities are present, but the manifest declares no explicit tool scope or permissions. That creates an authorization gap: the skill appears read-only and harmless to reviewers while still being able to access sensitive runtime data or other capabilities through the handler.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level documentation and manifest promise quota, session time, tokens, and context display. However, generateUsageReport only prints quota and reset time, while token and context fields are collected in stats but never shown in the user-facing report.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The handler invokes an external command via execSync to gather status data, which introduces command-execution risk and trust on ambient PATH-resolved binaries. Even though the command string is constant and not directly user-controlled here, a compromised environment or malicious binary named 'clawdbot' could cause unintended code execution whenever the skill runs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a display-oriented statistics skill, which implies read/report behavior. In addition to reading usage data, the code creates and rewrites ~/.clawdbot/quota-tracker.json to maintain its own state, which is a behavioral expansion beyond simply displaying session statistics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L030 forces number formatting with the 'en-US' locale. This is a natural-language/locale policy concern because the skill imposes a specific locale on all users without any opt-in, configurability, or documented region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code uses toLocaleString('en-US') for displayed token counts, which forces a specific locale in user-facing output. That can violate language/locale policy expectations when no user choice or regional justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: handler.js:48