OpenClaw Network Diagnostics

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:50 AM UTC
• Version: 0.1.1

Overview

This is a coherent Telegram network diagnostics skill, but it should be reviewed carefully because it can expose bot credentials, send live Telegram messages, and run as a persistent background network worker.

Install only if you control the Telegram bot, chat, host, and config files. Keep telegram_api_host set to api.telegram.org unless you intentionally trust another endpoint, keep redaction enabled, protect or minimize logs, avoid --proxy until the plaintext runtime-config behavior is fixed, prefer foreground mode for testing, and rotate the bot token if validate-config output or .netdiag.runtime.config.json may have exposed it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/netdiag.py:1774

Finding

Configuration Validation Exposes Telegram Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/netdiag.py:1834

Finding

Proxy Override Persists a Plaintext Copy of the Bot Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/netdiag.py:1247

Finding

Unrestricted API Host Can Redirect Bot Credentials to a Non-Telegram Server

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/netdiag.py:1710

Finding

Unverified PID File Can Terminate an Unrelated Process

Content

View full analysis

bool: if pid <= 0: return False try: os.kill(pid, 0) except OSError: return False return True ``` ### Technical Analysis The `stop` command accepts a user-selected PID-file path and trusts the integer stored in it. Before sending `SIGTERM`, the code verifies only that a process currently exists at the specified PID. It does not verify: - That the process is an instance of `netdiag.py`. - That the process command line matches the expected worker. - That the PID has not been recycled since the file was written. - A process start timestamp or other stable identity. - A worker-specific random nonce. - Ownership and secure permissions of the PID file. As a result, a replaced, stale, or deliberately supplied PID file can cause the command to signal an unrelated process. Operating-system permission checks still apply, so the invoking user can generally terminate only processes that user is authorized to signal. ### Attack Path 1. An attacker identifies a process that the operator is permitted to terminate. 2. The attacker writes that process's PID into a PID file writable by the attacker, or persuades the operator to use an attacker-controlled path. 3. The operator runs: ```bash python3 scripts/netdiag.py stop --pid-file /path/to/controlled.pid ``` 4. `is_process_alive` confirms that some proces ...[truncated 787 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes operational behavior that clearly relies on shell execution, file reads/writes, and likely environment access for credentials, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runs the skill with broader-than-necessary capabilities, making unintended command execution, file access, or secret exposure harder to review and constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill actively sends real Telegram messages and may poll for acknowledgements from a personal chat, but the user-facing description does not prominently warn about these externally visible side effects. This can cause unintended message delivery, surprise user interaction, rate-limit exposure, or accidental testing against production accounts without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The logging model states that records may include IPs, ports, DNS snapshots, TLS metadata, HTTP headers, payload sizes, rate-limit metadata, and stack traces, yet the skill lacks a clear warning that these logs can contain sensitive operational and network information. If logs are retained, shared, or analyzed later, they may expose infrastructure details, identifiers, or secrets-in-context that increase reconnaissance and privacy risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script executes external networking tools such as dig, traceroute, and ping, which gives the skill direct host-level probing capability. While arguments are mostly fixed, this still broadens the attack surface and can be abused for reconnaissance, traffic generation, or running privileged diagnostics from within the agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes start/stop/status process-management and persistent background execution via PID files and signals, which exceeds pure diagnostics and creates session persistence on the host. In an agent skill context, this is risky because it enables long-lived autonomous activity and can continue network probing or message sending after the initial invocation ends.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/netdiag.py (reported line 1697)May include surrounding context.

python

"--background",
    ]

    process = subprocess.Popen(
        cmd,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The explicit 'start background worker' capability provides persistence beyond the immediate command session. In a security-sensitive agent ecosystem, persistence materially increases risk because the tool can continue polling Telegram, generating logs, and interacting with the network without continuous operator awareness.

Content

Scanner excerpt · scripts/netdiag.py (reported line 1792)May include surrounding context.

python

run_parser.add_argument("--pid-file", default="./logs/netdiag.pid", help="PID file path")
    run_parser.add_argument("--background", action="store_true", help=argparse.SUPPRESS)

    start_parser = sub.add_parser("start", help="Start background worker")
    start_parser.add_argument("--config", help="Path to config JSON")
    start_parser.add_argument("--proxy", help="Override proxy URL")
    start_parser.add_argument("--pid-file", default="./logs/netdiag.pid", help="PID file path")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When --proxy is used, the code writes a .netdiag.runtime.config.json file containing the merged configuration, including bot token and personal chat ID, without warning or permission hardening. This creates a plaintext secret-spillage risk on disk, especially in shared workspaces, repositories, backups, or multi-user systems.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/netdiag.py (reported line 549)May include surrounding context.

python

for signame in ("SIGINT", "SIGTERM"):
            if hasattr(signal, signame):
                sig = getattr(signal, signame)
                try:
                    loop.add_signal_handler(sig, _handle_signal, signame)
                except NotImplementedError:

Static analysis

No suspicious patterns detected.