Security audit

Agent Messenger

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real messaging helper, but it uses stored Telegram bot credentials to send messages to a hardcoded Telegram user by default and can install recurring outbound heartbeats.

Review carefully before installing. Change or remove the hardcoded Telegram user ID, verify which bot tokens are present in /data/.openclaw/openclaw.json, and do not send secrets or sensitive operational details. Do not run the cron installer unless you intentionally want recurring outbound Telegram messages and have confirmed the schedule and removal steps.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The script prints that the output confirms all agents received the message, but it never verifies delivery status or acknowledgements from Telegram. This creates a false sense of operational assurance and can cause operators to believe critical heartbeat checks succeeded when messages may have failed or gone unacknowledged.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script reads Telegram bot tokens from a local configuration file and uses them to impersonate agents when sending messages. Accessing and operationalizing credentials inside a skill is security-sensitive because it enables outbound actions as those agents, and there is no visible access control, approval step, or scope restriction around which agents can be targeted.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script sends outbound Telegram messages on behalf of configured agents to a fixed user ID, which can be abused for unauthorized communication, phishing, spam, or covert signaling. Because it acts using agent bot identities rather than a clearly scoped user account, the external transmission capability is more dangerous than ordinary notification logic.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly promotes broadcasting messages to external channels, triggering workflows, and installing scheduled cron jobs, but it does not warn users that it can send data off-platform or modify persistent system scheduling. In an agent environment, this increases the chance of unintended outbound messaging, unauthorized automation, or persistent behavior being invoked without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Telegram API example demonstrates direct outbound transmission using bot tokens and user IDs, but provides no guidance on secure credential storage, secret redaction, or the sensitivity of message contents. This can lead users to expose tokens in shell history or logs and to send sensitive data to third-party infrastructure without understanding the disclosure risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script sends operator-supplied message content to Telegram for all agents without an explicit warning or confirmation that the content will leave the local environment. In security-sensitive workflows, this can lead to unintentional external disclosure of internal operational details, identifiers, or sensitive text.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This code combines credential access with external transmission of user-supplied content, yet provides no user-facing warning, consent, or transparency about using bot tokens and sending data to Telegram. That creates a meaningful risk of covert exfiltration or unauthorized outbound messaging, especially since the destination user ID is hardcoded and not explained.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script reads Telegram bot tokens from a local config file and immediately uses them to send data to an external service, with no access control, confirmation, or limitation on destination user IDs. In an agent-skill context, this creates a practical exfiltration channel because any caller able to run the script can abuse stored bot credentials to transmit arbitrary content to Telegram recipients outside the platform's normal routing controls.

Static analysis

No suspicious patterns detected.