ClawHub
Back to skill

Security audit

Telegram .md File Uploader

Security checks for vulnerabilities and agentic risk

Overview

This skill openly uploads a user-selected Markdown file to a configured Telegram chat, with no hidden persistence or unrelated behavior found.

Only use this for Markdown files you intentionally want to share outside your workspace. Confirm your TELEGRAM_CHAT_ID points to the intended recipient, avoid uploading files containing secrets or private business data, and note that the included script appears malformed until its indentation and documented path are fixed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Content
import requests
import argparse
import sys
import os

def send_file(file_path):
token = os.environ.get("TELEGRAM_BOT_TOKEN")
chat_id = os.environ.get("TELEGRAM_CHAT_ID")

if not token or not chat_id:
print("Error: TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID must be set as environment variables.")
sys.exit(1)

if not os.path.exists(file_path):
print(f"Error: File {file_path} not found.")
sys.exit(1)

if not file_path.endswith('.md'):
print(f"Error: {file_path} is not a valid Markdown (.md) file.")
sys.exit(1)

url = f"https://api.telegram.org/bot{token}/sendDocument"

try:
with open(file_path, 'rb') as f:
files = {'document': f}
data = {'chat_id': chat_id}
response = requests.post(url
Confidence
85% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill instructs use of both environment variables and outbound network access to send workspace files to Telegram, but it does not declare any explicit tool scope or permissions. This creates a governance and consent gap: an agent could access secrets from the environment and exfiltrate local markdown files over the network without clear, reviewable permission boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"Error: {file_path} is not a valid Markdown (.md) file.")
sys.exit(1)

url = f"https://api.telegram.org/bot{token}/sendDocument"

try:
with open(file_path, 'rb') as f:
Confidence
95% confidence
Finding
This code sends file contents to an external network endpoint, the Telegram Bot API. While external transmission is the intended function of the skill, it is still security-relevant because it moves potentially sensitive local data outside the workspace boundary to a third-party service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill transmits a local workspace file to an external Telegram chat without any interactive confirmation, recipient display, or content warning. In an agent-skill context, this increases the risk of unintentional disclosure of sensitive workspace data because the operation is an outbound exfiltration action by design.

Static analysis

No suspicious patterns detected.