T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_telegram_direct.py:57- Finding
Messages Are Sent to a Hard-Coded Telegram Recipient
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Messenger
Security checks for vulnerabilities and agentic risk
Overview
The skill has a real messaging purpose, but it sends through local Telegram bot tokens to a built-in Telegram user ID and can install recurring sends, so it needs careful review before use.
Install only if you control the Telegram recipient ID and are comfortable with the skill reading OpenClaw Telegram bot tokens. Before use, remove or replace the hard-coded user ID, require an explicit approved recipient, avoid sending secrets, and do not install the cron heartbeat until the schedule, log path, and uninstall behavior have been reviewed.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Warning
- Location
scripts/install_heartbeat_cron.sh:5- Finding
Unsafe Persistent Cron Entry Construction
- Content
View full analysis
/tmp/heartbeat.log 2>&1" ``` `scripts/install_heartbeat_cron.sh:17-29` ```bash if crontab -l 2>/dev/null | grep -q "heartbeat_check.sh"; then echo "⚠️ Cron job already exists!" echo "" echo "Current crontab:" crontab -l | grep heartbeat echo "" read -p "Remove and reinstall? (y/n) " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then crontab -l | grep -v "heartbeat_check.sh" | crontab - echo "✅ Removed old job" else exit 0 fi fi ``` `scripts/install_heartbeat_cron.sh:33` ```bash (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab - ``` ### Technical Analysis Installing a recurring cron task is an explicitly documented feature of the Skill, so persistence is not concealed and is functionally related to scheduled heartbeats. Nevertheless, the implementation exceeds safe minimum behavior in several ways: - `CRON_INTERVAL` is copied directly from the first argument into crontab text without validating that it is a legitimate schedule expression. - Embedded newline characters could introduce additional crontab entries if untrusted input reaches this argument. - `HEARTBEAT_SCRIPT` is inserted into a shell command without shell-safe quoting. Spaces or shell metacharacters in the installation path can alter execution. - Existing jobs are detected and removed ...[truncated 2149 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/install_heartbeat_cron.sh:13- Finding
Predictable Shared Temporary Log File Used by Cron
- Content
View full analysis
/tmp/heartbeat.log 2>&1" ``` `scripts/install_heartbeat_cron.sh:38-40` ```bash echo "📝 Logs saved to:" echo " /tmp/heartbeat.log" echo "" ``` ### Technical Analysis The recurring cron command redirects standard output and standard error to the fixed path `/tmp/heartbeat.log`. `/tmp` is normally shared among local users, while shell output redirection opens the target with truncation. On systems where symlink protections or temporary-directory hardening do not prevent the operation, another local user may pre-create this predictable path as a symbolic link. When cron runs, redirection can follow that link and truncate or overwrite a file writable by the cron account. The predictable shared path can also expose heartbeat output to other local users if file permissions are permissive. Although the current heartbeat output does not print bot tokens, it includes message content and agent-related operational status. ### Attack Path 1. A local attacker predicts the fixed log name `/tmp/heartbeat.log`. 2. Before the scheduled task runs, the attacker creates that path as a symbolic link to another file writable by the victim account. 3. Cron invokes the generated shell command. 4. The shell processes `> /tmp/heartbeat.log` and follows the link where platform protections permit it. 5. The linked file is truncated and receives heartbeat output. Alternatively, an attacker may read or manipulate the predictable log if its ownership and permissions permit access. ### Impact Assessment The maximum practical impact is limited to files writable by the user running the cron job. Potential effects include: - Truncation or corruption of user-owned files. - Disclos ...[truncated 441 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh #!/bin/bash # send_agent_msg.sh - Batch send messages to OpenClaw agents via Telegram set -e
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This script is expressly built to send arbitrary messages to a Telegram user ID, defaulting to a hard-coded recipient and supporting broadcast to all configured agents. In the context of direct token extraction and bypass of normal routing, that makes the messaging capability a plausible exfiltration or covert-command channel rather than a normal user-facing feature.
- Content
python return False, str(e) def main(): parser = argparse.ArgumentParser(description='Send messages to OpenClaw agents via Telegram') parser.add_argument('message', help='Message to send') parser.add_argument('--agents', nargs='+', default=['all'], help='Agent IDs (default: all)') parser.add_argument('--user-id', default='8341113912', help='Telegram user ID')
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says 'Use when' for broad scenarios like 'Broadcasting messages to multiple agents simultaneously' and 'Require scheduled or triggered message campaigns' without defining narrow trigger phrases or exclusions. In a manifest-style description, this can cause unintended invocation for generic messaging or notification requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill provides turnkey commands for bulk and recurring outbound messaging, including scheduled cron execution, without safety guardrails, consent/authorization checks, rate-limit guidance, or credential-handling warnings. In context, this lowers the barrier to spam, unintended mass outreach, and persistent automated messaging using sensitive bot credentials.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The cron-related guidance encourages persistent scheduled execution of a messaging workflow, which creates session/persistence risk by enabling recurring automated outreach beyond a one-time operator action. In this skill's context, persistence materially increases misuse potential because repeated heartbeats or campaigns can continue unattended and may be hard to notice or revoke.
- Content
Checks crontab:
bash crontab -l tail -f /tmp/heartbeat.log
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The direct reference to the Telegram API endpoint confirms the skill is designed for external transmission to a third-party service. While expected for a messaging skill, this still creates a real exfiltration and abuse surface if users send sensitive content, target unauthorized recipients, or mishandle the bot credential.
- Content
Pattern 1: Direct API Telegram (no chat resolution needed)
Uses bot tokens + user ID directly. Bypasses OpenClaw chat resolution issues.
bash curl -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \ -d "chat_id=<USER_ID>&text=<MESSAGE>"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The direct reference to the Telegram API endpoint confirms the skill is designed for external transmission to a third-party service. While expected for a messaging skill, this still creates a real exfiltration and abuse surface if users send sensitive content, target unauthorized recipients, or mishandle the bot credential.
- Content
Pattern 1: Direct API Telegram (no chat resolution needed)
Uses bot tokens + user ID directly. Bypasses OpenClaw chat resolution issues.
bash curl -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \ -d "chat_id=<USER_ID>&text=<MESSAGE>"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script states that the output confirms all agents received the message, but it never verifies message delivery or checks for acknowledgments. In an operational setting, this can create false assurance that agents are reachable or responsive, which may delay incident response or hide communication failures.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
This script installs a recurring cron entry, which is a persistence mechanism by design. Even though the apparent purpose is administrative and not overtly malicious, any code that establishes scheduled execution creates ongoing execution on the host and can be abused if the referenced heartbeat script is modified or if the installer is run without adequate review.
- Content
sh CRON_JOB="$CRON_INTERVAL * * * * bash $HEARTBEAT_SCRIPT > /tmp/heartbeat.log 2>&1" # Check if already exists if crontab -l 2>/dev/null | grep -q "heartbeat_check.sh"; then echo "⚠️ Cron job already exists!" echo "" echo "Current crontab:"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "⚠️ Cron job already exists!" echo "" echo "Current crontab:" crontab -l | grep heartbeat echo "" read -p "Remove and reinstall? (y/n) " -n 1 -r echo
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "⚠️ Cron job already exists!" echo "" echo "Current crontab:" crontab -l | grep heartbeat echo "" read -p "Remove and reinstall? (y/n) " -n 1 -r echo
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "⚠️ Cron job already exists!" echo "" echo "Current crontab:" crontab -l | grep heartbeat echo "" read -p "Remove and reinstall? (y/n) " -n 1 -r echo
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
This line appends a new cron job to the current user's crontab, establishing recurring execution and therefore persistence. In the skill context, that is the explicit function of the script, which makes the finding more credible, and it becomes dangerous if users do not fully understand that a background task will continue running indefinitely.
- Content
sh fi # Install new job (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab - echo "✅ Installed cron job!" echo ""
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo " /tmp/heartbeat.log" echo "" echo "🛑 To remove:" echo " crontab -e # then delete the heartbeat line" echo ""
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" CONFIG_FILE="/data/.openclaw/openclaw.json" TELEGRAM_API="https://api.telegram.org/bot" # Parse arguments MESSAGE=""
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" CONFIG_FILE="/data/.openclaw/openclaw.json" TELEGRAM_API="https://api.telegram.org/bot" # Parse arguments MESSAGE=""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script extracts account IDs and Telegram bot tokens from the local config file, which constitutes access to sensitive credentials, but there is no comment, docstring, or user-facing disclosure explaining that credential material will be read. Under the code-file criteria, sensitive credential access should not be silent when no markdown warning is available.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh EMOJI=$(jq -r ".agents.list[] | select(.id==\"$agent\") | .identity.emoji // \"\"" "$CONFIG_FILE") # Send via Telegram API RESPONSE=$(curl -s -X POST "${TELEGRAM_API}${BOT_TOKEN}/sendMessage" \ -d "chat_id=$USER_ID" \ -d "text=$EMOJI $AGENT_NAME: $FINAL_MESSAGE")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script performs an outbound HTTP request to the Telegram API and transmits the composed message, agent name, emoji, and target chat ID, but the only nearby comment says 'Send via Telegram API' and there is no user-facing warning about external data transmission. For code files, network calls that transmit user or system data should have visible disclosure unless the warning is provided elsewhere in markdown, which is not present in this file.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads the OpenClaw configuration, locates Telegram account bindings, and extracts bot tokens in order to send messages outside the normal platform flow. Accessing and using credentials directly is sensitive behavior, and here it is paired with a stated goal of bypassing the normal chat-resolution mechanism, which materially increases the risk of unauthorized messaging and abuse of stored secrets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code pulls Telegram bot tokens from local configuration and immediately uses them to perform outbound HTTP requests, without any warning, consent flow, or trust boundary documentation. Even if the intent is operational convenience, this creates a stealthy credential-use and external-transmission path that can be repurposed for unauthorized communication or data exfiltration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default message text is hard-coded in French: "Tout le monde là? Envoie ✅ si tu reçois". This imposes a specific language on users/agents without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation category.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The docstring claims the tool is for agent messaging, but it explicitly 'bypasses OpenClaw chat resolution' and sends directly to an arbitrary Telegram user ID. That mismatch is dangerous because it conceals the real security-sensitive behavior and can mislead reviewers or operators about the destination and control boundaries of outbound messages.
- Content
Static analysis
No suspicious patterns detected.