T09 · Insecure Skill Coding Practices
Warning
- Location
CONFIGURATION.md:71- Finding
Plaintext Telegram Bot Credential Persistence and Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
CONFIGURATION.md:71-75,CONFIGURATION.md:293-300, andREADME.md:358-361
Vulnerability Type: Plaintext secret storage and unsafe credential disclosure
Risk Level: MediumThe configuration documentation instructs users to persist a Telegram bot token in a plaintext shell initialization file and to print the token during troubleshooting.
bash **Permanent (add to ~/.bashrc or ~/.profile):** ```bash echo 'export TELEGRAM_BOT_TOKEN="1234567890:ABCdefGHIjklMNOpqrsTUVwxyz"' >> ~/.bashrc echo 'export TELEGRAM_CHAT_ID="123456789"' >> ~/.bashrc source ~/.bashrctext It also recommends displaying the token and expanding it into a command-line URL: ```bash **Checklist:** 1. Verify bot token: `echo $TELEGRAM_BOT_TOKEN` 2. Verify chat ID: `echo $TELEGRAM_CHAT_ID` 3. Test connectivity: ```bash curl https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getMetext The README repeats the unsafe terminal disclosure: ```bash **Check:** ```bash echo $TELEGRAM_BOT_TOKEN echo $TELEGRAM_CHAT_IDtext ### Technical Analysis Telegram bot tokens are bearer credentials. A party possessing a valid token can authenticate to Telegram's Bot API without an additional secret. Writing the token to `~/.bashrc` or `~/.profile` stores it unencrypted for an indefinite period. The token may consequently be exposed to other processes or users able to read the profile, workstation backups, diagnostic collections, accidental profile sharing, or source-control mistakes. Running `echo $TELEGRAM_BOT_TOKEN` exposes the complete token in terminal output, where it may be captured by screen sharing, recordings, scrollback, CI logs, support transcripts, or terminal logging. Expanding the token into the `curl` URL can additionally make it temporarily visible in process arguments to local process-monitoring tools. Although the shell commonly records the unexpanded variable expression in history, tooling around command exe ...[truncated 1735 chars]- Remediation
View remediation
Remediation Suggestions
- Remove instructions that persist bot tokens directly in
~/.bashrcor~/.profile. - Store credentials in a dedicated secret manager when available. As a local fallback, use a separate file with restrictive permissions:
bash install -m 600 /dev/null ~/.crypto-oracle.env printf '%s\n' \ 'TELEGRAM_BOT_TOKEN="replace_with_token"' \ 'TELEGRAM_CHAT_ID="replace_with_chat_id"' \ > ~/.crypto-oracle.env - Ensure any scheduled execution loads secrets from the protected file without placing literal credentials in crontab entries.
- Replace token-printing checks with redacted validation, such as reporting only whether the variable is set:
bash if [ -n "${TELEGRAM_BOT_TOKEN:-}" ]; then echo "TELEGRAM_BOT_TOKEN is configured" else echo "TELEGRAM_BOT_TOKEN is not configured" fi - Avoid placing the token in command-line arguments. Use the application’s test mode or a protected configuration mechanism instead of the documented
curlcommand. - Warn users not to include tokens in screenshots, support logs, shell profiles, source control, or shared diagnostic output.
- Document incident response: revoke and regenerate the token through BotFather immediately if disclosure is suspected, then update all authorized secret stores.
- Apply least privilege to the Telegram bot by granting it only the group or channel permissions required for report delivery.
- Remove instructions that persist bot tokens directly in