ClawHub
Back to skill

Security audit

emoji and tg stickers use proactively based on mood

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it automatically sends Telegram messages and has a real helper-script input handling flaw, so it belongs in Review before installation.

Install only if you are comfortable with an agent automatically posting stickers into Telegram chats through your bot. Use a dedicated low-privilege bot token, restrict where the bot is present, avoid using this in formal or sensitive chats, and fix or avoid the --emoji helper path until input is passed safely to Python.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/send_sticker.sh:60
Finding

Python Code Injection Through Unsafely Interpolated Emoji Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_sticker.sh:17
Finding

Telegram Bot Token Exposed in Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The manifest presents the skill as lightweight expressive reactions, but the content enables additional operational behavior: use of a bot token, shell-based message sending, sticker-pack enumeration, and session caching. This mismatch prevents users and platforms from understanding the true capabilities of the skill, increasing the chance of unintended autonomous outbound actions and overbroad access.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is designed to activate on every Telegram message and act proactively, which is an overly broad trigger for an outbound-action capability. Because it can send messages without explicit per-message consent, ordinary conversation can cause unauthorized or embarrassing bot actions at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to proactively send Telegram stickers on the user's behalf but does not prominently warn users that autonomous outbound messaging will occur. This is dangerous because users may not realize the agent can post to chats without direct prompting, creating privacy, trust, and reputational risks.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/send_sticker.sh (reported line 40)May include surrounding context.

sh
send_sticker_by_id() {
  local chat_id="$1" file_id="$2"
  curl -s -X POST "${API}/sendSticker" \
    -d chat_id="${chat_id}" \
    -d sticker="${file_id}"
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes a shell script and relies on sensitive environment variables, but it declares no tool scope or permissions. This creates hidden execution capability: an agent may run shell commands and send Telegram messages without explicit authorization boundaries, undermining least privilege and making review and enforcement harder.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

Autonomous decision-making is risky here because the skill is authorized to perform an external side effect—sending Telegram content—without explicit user instruction each time. In a messaging context, even low-stakes reactions can become unauthorized communications that affect privacy, professionalism, or user relationships.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: telegram-sticker-vibes
description: Automatically send Telegram stickers and emojis that match the mood and vibe of the conversation. Activates on every Telegram message to add expressive, human-like sticker and emoji reactions without being asked. Use this skill whenever you are chatting on Telegram to make conversations feel alive and fun.
metadata:
  openclaw:
    emoji: "🎭"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The decision logic relies on vague heuristics like 'trust your instinct' and casual vibe interpretation to trigger external actions. Ambiguous triggers are dangerous for agentic systems because they lead to unpredictable behavior, accidental sends, and inconsistent enforcement of user intent and safety constraints.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_sticker.sh (reported line 18)May include surrounding context.

sh
exit 1
fi

API="https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}"

usage() {
  cat <<EOF

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes a skill that automatically adds expressive sticker and emoji reactions in Telegram conversations. However, this script also supports --list-set, which retrieves and prints all stickers in an arbitrary sticker set with their file IDs and emoji mappings, a broader inspection capability not implied by the stated reactive purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_sticker.sh (reported line 40)May include surrounding context.

sh
send_sticker_by_id() {
  local chat_id="$1" file_id="$2"
  curl -s -X POST "${API}/sendSticker" \
    -d chat_id="${chat_id}" \
    -d sticker="${file_id}"
}

Scope Creep

Low
Category
Excessive Agency
Confidence
82% confidence
Finding

Telling the agent it is 'not limited' to listed sticker sets and to discover new ones expands operational scope beyond a tightly bounded reaction helper. This increases unpredictability, external API usage, and the chance of interacting with unreviewed content sources, even if the immediate impact is relatively limited.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
- `DevLife` — developer life stickers (bugs, coffee, shipping)
- `CoffeeCat` — cat with coffee, perfect for "getting stuff done" vibes

You are NOT limited to these sets. If you know of other sticker sets that fit, use them. You can also discover new sets by exploring Telegram sticker packs.

## Mood → Sticker Mapping

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a skill for automatically sending stickers and emojis that match conversation mood. Line L104 expands this into discovering other sticker sets by exploring Telegram sticker packs, which is not necessary to fulfill the core purpose of reacting with stickers and adds a broader browsing capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest presents the skill as automatically sending expressive Telegram stickers and emojis during chats. L149-L151 instruct the agent to list sticker sets and remember file IDs for later reuse, which introduces session-level data retention and optimization behavior beyond the plainly stated user-facing purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest frames the skill as automatically sending Telegram stickers and emoji reactions during chats, but does not mention credential handling or requiring access to bot authentication material. Accessing TELEGRAM_BOT_TOKEN is a sensitive capability that should be explicitly justified or declared when the skill's description is otherwise purely behavior-focused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.