Telegram Usage Stats

• Outcome: Pass
• Latest audit: May 27, 2026, 9:05 PM
• Version:
  1.0.1

Overview

This skill appears to display local Clawdbot usage statistics as advertised, with local command and session-file access that are disclosed and purpose-aligned.

Install this only where you trust the local Clawdbot installation and the clawdbot command in PATH. Be aware it can touch local Clawdbot usage/session data, and any Telegram output should be shared only with the intended chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The handler invokes an external CLI via execSync to obtain usage data, which expands the trust boundary from local code to the shell environment and whatever executable resolves as clawdbot. In an agent-skill context, this is risky because PATH hijacking, unexpected shell execution semantics, or a compromised external tool could cause arbitrary code execution or unintended side effects under the skill's privileges.

VirusTotal

66/66 vendors flagged this skill as clean.