Telegram File Sender

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.0.1

Overview

This skill does what it claims, but it can send any readable local file to Telegram without enough path limits, sensitive-file warnings, or explicit confirmation.

Install only if you trust the chat context and are comfortable with the agent being able to send any file it can read through Telegram. Before use, prefer adding guardrails: restrict allowed directories, block sensitive paths such as keys and environment files, resolve symlinks, validate the Telegram target from trusted context, and require explicit confirmation of the final path and destination before upload.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/send_file.sh:2
• Finding: Unrestricted Transmission of Arbitrary Local Files## Vulnerability Details **File Location**: `scripts/send_file.sh:2-17`; `SKILL.md:8-11, 21` **Vulnerability Type**: Unrestricted local-file access and transmission **Risk Level**: High ### Vulnerable Code `scripts/send_file.sh:2-17` ```bash # Telegram File Sender Script path="$1" caption="${2:-File from OpenClaw}" target="${3}" # e.g., telegram:1234567890 — read from Inbound Context chat_id if [ ! -f "$path" ]; then echo "File not found: $path" exit 1 fi if [ -z "$target" ]; then echo "No target specified. Pass chat_id from Inbound Context as 3rd arg (e.g., telegram:1234567890)" exit 1 fi echo "Sending $path to $target..." openclaw message send --channel telegram --target "$target" --media "$path" --message "$caption" ``` `SKILL.md:8-11, 21` ```markdown 1. Confirm file exists (read path). 2. Read `chat_id` from the `## Inbound Context (trusted metadata)` JSON block in the system prompt (value looks like `telegram:1234567890`). 3. Run `scripts/send_file.sh <path> ['caption'] <chat_id>`. 4. Confirm sent (msg ID logged). **Resolve paths:** workspace rel, abs ok. ``` ### Technical Analysis The script accepts any path supplied as its first argument and verifies only that the path identifies a regular file. It does not canonicalize the path, restrict access to an approved workspace or export directory, reject symbolic-link traversal, or screen sensitive system locations. The skill instructions explicitly permit absolute paths. Consequently, any file readable by the agent process can be supplied to `openclaw message send` and transmitted to Telegram. The implementation also lacks an explicit confirmation step that presents the resolved path and destination to the user before disclosure. The vulnerability does not independently grant filesystem permissions beyond those already held by the agent. However, it breaks least-privilege boundaries by exposing the agent's existi ...[truncated 1149 chars]
• Remediation: ## Remediation Suggestions 1. Canonicalize the requested path with a platform-appropriate utility before validation. 2. Permit transfers only from explicitly approved workspace or export directories. 3. Verify that the canonical path remains beneath an approved directory boundary. 4. Reject symbolic links, or resolve them and repeat the directory-boundary check on the final target. 5. Deny known sensitive files and directories, including credential stores, private keys, environment files, system configuration, and agent metadata. 6. Require explicit confirmation that displays the canonical file path, file size, and Telegram destination before uploading. 7. Validate the destination against the trusted inbound session context rather than accepting an arbitrary third argument. 8. Run the skill under a dedicated account with minimal filesystem permissions. 9. Record auditable transfer metadata without logging file contents or credentials.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/send_file.sh:17
• Finding: Unconditional Success Reporting After Failed File Transfer## Vulnerability Details **File Location**: `scripts/send_file.sh:17-19` **Vulnerability Type**: Improper error handling and false success reporting **Risk Level**: Low ### Vulnerable Code ```bash openclaw message send --channel telegram --target "$target" --media "$path" --message "$caption" echo "Sent!" ``` ### Technical Analysis The script does not inspect or propagate the exit status of `openclaw message send`. Because Bash continues to the next statement by default, the script prints `Sent!` even when the upload fails due to authentication errors, an invalid destination, unavailable network service, rejected media, or another command failure. The script may also finish with a successful status because the final `echo` succeeds, masking the failure from the calling agent or automation. This can cause the agent to provide an inaccurate delivery confirmation and creates unreliable operational and audit records. ### Attack Path 1. The transfer command is made to fail, such as through an invalid or unavailable Telegram target, gateway failure, authentication failure, or network interruption. 2. `openclaw message send` exits with a nonzero status. 3. The script continues because the failure is not checked. 4. The script prints `Sent!`. 5. The successful `echo` can cause the overall script to return zero, leading the calling agent to report a transfer that did not occur. ### Impact Assessment This issue does not directly grant additional privileges or disclose data. Its primary impact is loss of integrity and reliability in delivery status, automation, retry logic, and audit trails. Users may incorrectly believe that a required file was delivered, potentially causing operational failures or delayed detection of Telegram configuration and authentication problems.
• Remediation: ## Remediation Suggestions Enable strict error handling and emit success only after the transfer command returns successfully. For example: ```bash #!/bin/bash set -euo pipefail if openclaw message send \ --channel telegram \ --target "$target" \ --media "$path" \ --message "$caption"; then echo "Sent!" else status=$? echo "File transfer failed with exit status $status" >&2 exit "$status" fi ``` Additionally, capture and validate the message identifier returned by OpenClaw when available, propagate nonzero exit codes to the caller, and ensure that the agent reports success only from validated command output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly promotes sending arbitrary local files from the host to a Telegram chat, but it does not warn about sensitive data exposure, path safety, or authorization boundaries. In the context of an agent skill that auto-routes to the current chat and is intended to be used broadly, this increases the risk of exfiltrating secrets, private documents, keys, logs, or other local data through normal-looking user prompts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly says to use it for "ALL sessions" whenever a user asks to send files via Telegram, which is overly broad activation language that can force invocation in situations where a safer or more context-appropriate action should be chosen. Because this skill can transmit arbitrary local files to an external chat, over-triggering increases the chance of unintended data exfiltration or sending the wrong file without adequate user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The README includes a non-English trigger phrase as a supported invocation example, but it does not explain any locale scope or offer users a language-choice policy. If the skill expects or privileges a specific language, that should be explicitly optional or justified to avoid an unnecessary language/locale constraint.

Static analysis

No suspicious patterns detected.