ClawHub
Back to skill

Security audit

tg buttons

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Telegram bot helper that styles choice buttons and sends user-directed test messages, with no evidence of hidden exfiltration or persistence.

Before installing, treat BOT_TOKEN as sensitive, avoid passing it where command histories or process lists may expose it, keep .env out of version control, and consider pinning dependency versions in the generated requirements file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/setup_openclaw_bot.sh:20
Finding

Unpinned Python Dependencies Permit Unreviewed Supply-Chain Updates

Content
View full analysis

Vulnerability Details

File Location: scripts/setup_openclaw_bot.sh:20-23 and installation instruction at scripts/setup_openclaw_bot.sh:207
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable dependency declaration (scripts/setup_openclaw_bot.sh:20-23):

bash
# --- requirements.txt ---
cat > "$PROJECT_DIR/requirements.txt" << 'EOF'
requests>=2.28.0
python-dotenv>=1.0.0
EOF

Installation instruction (scripts/setup_openclaw_bot.sh:207):

bash
echo "  3. pip install -r requirements.txt"

Technical Analysis

The generated requirements.txt specifies only minimum versions. Consequently, each installation may resolve to a different, newly published dependency version that was not present during the Skill audit. The installation command does not require package hashes, use a reviewed lock file, or explicitly enforce a trusted package index.

If a permitted dependency version or the configured Python package index is compromised, pip can retrieve an attacker-controlled wheel or source distribution. Source distributions may execute build-related code during installation. A malicious dependency can also execute when the generated bot imports requests or python-dotenv.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

Attack Path

  1. An attacker compromises a future permitted release of requests or python-dotenv, compromises a configured package index, or otherwise influences dependency resolution.
  2. The user runs pip install -r requirements.txt as instructed.
  3. Because the constraints accept all versions at or above the stated minimums and no hashes are checked, pip downloads the attacker-controlled artifact.
  4. Malicious code executes during source-package build or when the generated bot imports the installed package.
  5. The malicious dependency reads the gene ...[truncated 997 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace lower-bound constraints with exact, reviewed versions, for example:
    text
    requests==REVIEWED_VERSION
python-dotenv==REVIEWED_VERSION
  2. Generate a lock file containing hashes for every direct and transitive dependency, using a controlled tool such as pip-compile --generate-hashes.
  3. Install with hash enforcement:
    bash
    python -m pip install --require-hashes -r requirements.lock
  4. Explicitly use an approved HTTPS package index and prevent fallback to untrusted extra indexes.
  5. Install inside a dedicated virtual environment under a non-privileged account; never run the installation as root.
  6. Review dependency provenance, release changes, and vulnerability advisories before updating locked versions.
  7. Protect .env with restrictive filesystem permissions, exclude it from version control, and rotate BOT_TOKEN immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 68)May include surrounding context.

sh
ick one:",
        choices=[
            {"text": "Yes", "data": "yes"},
            {"text": "No",  "data": "no", "style": "destructive"},
            {"text": "Skip","data": "skip", "style": "secondary"},
        ],
    )
"""

import os
import json
import requests
from typing import Optional


class OpenclawBot:
    """Telegram bot client with colored button support."""

    API_BASE = "https://api.telegram.org/bot{token}"

    def __init__(self, token: Optional[str] = None):
        self.token = token or os.environ.get("BOT_TOKEN", "")
        if not self.token:
            raise ValueError("BOT_TOKEN is required (pass to constructor or set env var)")
        self.api_url = self.API_BASE.format(token=self.token)

    def _post(self, method: str, payload: dict) -> dict:
        """Send a request to the Bot API."""
        resp = requests.post(f"{self.api_url}/{method}", json=payload)
        resp.raise_for_status()
        result = resp.json()
        if not result.get("ok"):

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.sh (reported line 36)May include surrounding context.

sh
echo "  [Skip]          → secondary (gray)  — low-priority escape"
echo ""

RESPONSE=$(curl -s -X POST "$API_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "chat_id": "'"${CHAT_ID}"'",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 17)May include surrounding context.

sh
echo "==> Setting up Openclaw bot project in ${PROJECT_DIR}/..."
mkdir -p "$PROJECT_DIR"

# --- .env template ---
cat > "$PROJECT_DIR/.env" << 'EOF'
# Openclaw Bot Configuration
BOT_TOKEN=your-bot-token-from-botfather

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 217)May include surrounding context.

sh
echo "==> Setting up Openclaw bot project in ${PROJECT_DIR}/..."
mkdir -p "$PROJECT_DIR"

# --- .env template ---
cat > "$PROJECT_DIR/.env" << 'EOF'
# Openclaw Bot Configuration
BOT_TOKEN=your-bot-token-from-botfather

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 18)May include surrounding context.

sh
mkdir -p "$PROJECT_DIR"

# --- .env template ---
cat > "$PROJECT_DIR/.env" << 'EOF'
# Openclaw Bot Configuration
BOT_TOKEN=your-bot-token-from-botfather
# Optional: default chat ID for testing

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 212)May include surrounding context.

sh
mkdir -p "$PROJECT_DIR"

# --- .env template ---
cat > "$PROJECT_DIR/.env" << 'EOF'
# Openclaw Bot Configuration
BOT_TOKEN=your-bot-token-from-botfather
# Optional: default chat ID for testing

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown skill description includes examples for deleting all messages, deleting data, and transferring tokens, but it focuses only on button color semantics rather than warning users about data loss or monetary consequences. Under the markdown-file criteria, behaviors that could affect user data or finances should include explicit warnings in the skill description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
"reply_markup": {"inline_keyboard": keyboard},
    }
    url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
    resp = requests.post(url, json=payload)
    resp.raise_for_status()
    return resp.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script reads BOT_TOKEN and CHAT_ID from command-line arguments or environment variables, then uses them in a curl request to the Telegram Bot API. Although the file comments explain usage, they do not warn that a credential is being consumed and sent to an external service, which is the kind of sensitive operation this rule covers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md
exit 1
fi

API_URL="https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"

echo "==> Sending auto-colored choice buttons to chat ${CHAT_ID}..."
echo ""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.sh (reported line 24)May include surrounding context.

sh
exit 1
fi

API_URL="https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"

echo "==> Sending auto-colored choice buttons to chat ${CHAT_ID}..."
echo ""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 68)May include surrounding context.

sh
exit 1
fi

API_URL="https://api.telegram.org/bot${BOT_TOKEN}/sendMessage"

echo "==> Sending auto-colored choice buttons to chat ${CHAT_ID}..."
echo ""

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.sh (reported line 36)May include surrounding context.

sh
echo "  [Skip]          → secondary (gray)  — low-priority escape"
echo ""

RESPONSE=$(curl -s -X POST "$API_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "chat_id": "'"${CHAT_ID}"'",

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup_openclaw_bot.sh (reported line 78)May include surrounding context.

sh
def _post(self, method: str, payload: dict) -> dict:
        """Send a request to the Bot API."""
        resp = requests.post(f"{self.api_url}/{method}", json=payload)
        resp.raise_for_status()
        result = resp.json()
        if not result.get("ok"):

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The example code sends data over the network to the Telegram Bot API, including chat_id, message text, and reply markup. In this markdown skill file, there is no explicit warning that using the helper transmits user content and metadata to Telegram.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The script creates a .env template that instructs the user to place a BOT_TOKEN in a local file, which is a credential-handling operation. While the script documents the setup flow, it does not include any warning or comment about protecting the token or avoiding accidental exposure of the .env file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.