Telegram Footer Patch

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:52 AM UTC
• Version: 1.0.11

Overview

The skill mostly matches its stated purpose, but it persistently patches installed OpenClaw runtime files and has a concrete rollback reliability problem, so it belongs in Review rather than automatic install.

Install only if you are comfortable patching OpenClaw's installed JavaScript bundles. Run dry-run first, use a staging instance when possible, keep an independent clean backup of the OpenClaw dist directory, and do not rely solely on the included revert script after repeated patch or upgrade cycles.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/revert_reply_footer.py:50

Finding

Rollback May Restore an Already-Patched Backup

Content

View full analysis

Remediation

View remediation

bool: content = path.read_text(encoding="utf-8") return ( MARKER_START not in content and "__ocMaybeAppendTelegramStatusFooter(reply.text, params)" not in content ) clean_backups = [ pathlib.Path(candidate) for candidate in sorted(backups, reverse=True) if is_clean_backup(pathlib.Pat ...[truncated 308 chars]

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code’s primary purpose is materially different from the declared description. It does not add a Telegram footer to OpenClaw replies; instead, it searches dist bundle files for a patch marker and restores them from existing .bak.telegram-footer backups. While some supporting features overlap with the description—dry-run, backup handling, syntax validation, and rollback-on-failure—the main behavior is reversal of a prior modification, not application of that modification. The claimed footer content insertion and restart guidance are absent from this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

python3 scripts/patch_reply_footer.py --dry-run --list-targets

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

python3 scripts/patch_reply_footer.py --dry-run --list-targets

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

python3 scripts/patch_reply_footer.py --dry-run --list-targets

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes operations that read environment state, invoke shell commands, and write directly into installed OpenClaw dist files, yet it declares no explicit tool scope or permission boundary. In an agent ecosystem, that omission is dangerous because the skill can cause filesystem modification and command execution without a machine-readable least-privilege constraint, increasing the risk of overbroad or unintended execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/patch_reply_footer.py (reported line 391)May include surrounding context.

python

return 2
    if not dry_run:
        if not os.access(dist, os.W_OK):
            print(f"[err] no write permission for dist directory: {dist} (try sudo or adjust permissions)", file=sys.stderr)
            return 2
    else:
        if not os.access(dist, os.R_OK):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/patch_reply_footer.py (reported line 210)May include surrounding context.

python

def verify_node_syntax(path: pathlib.Path):
    result = subprocess.run(["node", "--check", str(path)], capture_output=True, text=True, check=False)
    if result.returncode != 0:
        details = (result.stderr or result.stdout or "node --check failed").strip()
        raise RuntimeError(details)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/revert_reply_footer.py (reported line 28)May include surrounding context.

python

def verify_node_syntax(path: pathlib.Path):
    result = subprocess.run(["node", "--check", str(path)], capture_output=True, text=True, check=False)
    if result.returncode != 0:
        details = (result.stderr or result.stdout or "node --check failed").strip()
        raise RuntimeError(details)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill content includes substantial Chinese-only instructional text alongside English, but it does not state a language preference option or ask the user which language they want. This can violate a language/locale policy when a skill imposes or assumes a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.