Telegram Widgets Skill

• Outcome: Pass
• Latest audit: Nov 12, 2026 · 4:45 AM UTC
• Version: 1.0.2

Overview

ClawScan marks this skill benign with medium confidence: the reported findings were judged expected for its purpose, though one reference was unresolved and the scan is partial.

The verdict is benign, but benign does not mean risk-free. Consider the reported network, file-write, environment-access, subprocess, and allowlist findings before installing, and keep in mind that the unresolved reference makes the scan evidence incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 90, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tgwidget/telegram.py (reported line 92)May include surrounding context.

python

body = json.dumps({k: v for k, v in payload.items() if v is not None}).encode("utf-8")
        req = urllib.request.Request(url, data=body, headers={"Content-Type": "application/json"})
        try:
            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
                raw = resp.read()
        except urllib.error.HTTPError as e:
            # Telegram answers errors with a JSON body; read it, drop the exception (its text has the URL)

Code capability 'network' detected in scripts/tgwidget/check.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'file_write' detected in scripts/tgwidget/jssyntax.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_write' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'env' detected in scripts/tgwidget/target.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tgwidget/jssyntax.py (reported line 64)May include surrounding context.

python

with os.fdopen(fd, "w", encoding="utf-8") as f:
            # a function body, like QuickJS's check: `return` is fine, nothing runs
            f.write("(function(){\n" + code + "\n})")
        proc = subprocess.run(["node", "--check", path], capture_output=True, text=True, timeout=30)
    finally:
        os.unlink(path)
    if proc.returncode == 0:

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · scripts/tgwidget/urls.py (reported line 111)May include surrounding context.

python

return None
    target = host + (parts.path if host in TELEGRAM_HOSTS else "")
    if not allow:
        return "%s is not allowed: the link allowlist is empty (operator setting %s)" % (target, ENV_VAR)
    return "%s is not on the link allowlist (operator setting %s)" % (target, ENV_VAR)