T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/alert_poller.sh:16
- Finding
- Undeclared OpenClaw Credential Access and Telegram Bot Token Exposure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/alert_poller.sh:16-40` **Vulnerability Type**: Sensitive credential access and exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash OPENCLAW_CONFIG="$HOME/.openclaw/openclaw.json" if [ -f "$OPENCLAW_CONFIG" ]; then BOT_TOKEN=$(cat "$OPENCLAW_CONFIG" | jq -r '.channels.telegram.botToken // empty') CHAT_ID=$(cat "$OPENCLAW_CONFIG" | jq -r '.channels.telegram.chatId // empty') # Fallback to environment variables if not in config if [ -z "$BOT_TOKEN" ]; then BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}" fi if [ -z "$CHAT_ID" ]; then CHAT_ID="${TELEGRAM_CHAT_ID:-}" fi fi if [ -n "$BOT_TOKEN" ] && [ -n "$CHAT_ID" ]; then # URL encode the message MESSAGE=$(echo "$OUTPUT" | jq -sRr @uri) # Send to Telegram curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${CHAT_ID}" \ -d "text=${MESSAGE}" \ -d "parse_mode=Markdown" \ -d "disable_notification=false" > /dev/null ``` ### Technical Analysis The wrapper directly reads the global OpenClaw configuration file, extracts the Telegram bot token and chat identifier, and performs message delivery itself. This behavior is inconsistent with `SKILL.md`, which states that scripts write reports to standard output and that the agent handles delivery. Report generation and alert evaluation do not require access to the user's global OpenClaw credentials. The wrapper therefore crosses the minimum-privilege boundary established by the declared functionality. The Telegram bot token is also interpolated into curl's URL: ```bash "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" ``` After shell expansion, the complete token becomes part of curl's process arguments. Depending on operating-system process visibility and monitoring configuration, another local process, process-accounting service, diagnostic collec ...[truncated 2465 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove global credential access from the Skill wrapper.** - Make `alert_poller.py` and its wrapper return alert text through standard output only. - Delegate Telegram delivery to OpenClaw, matching the behavior documented in `SKILL.md`. - Remove reads of `~/.openclaw/openclaw.json`. 2. **Require explicit authorization if direct Telegram delivery is retained.** - Document the delivery behavior and required permissions. - Require a dedicated opt-in setting rather than automatically inspecting a global configuration file. - Use a bot created specifically for this Skill with the narrowest available Telegram permissions. 3. **Use a protected credential-delivery mechanism.** - Obtain credentials from a platform-managed secret provider or pre-opened protected file descriptor. - Restrict any dedicated credential file to the executing account, such as mode `0600`. - Do not print credentials or include them in diagnostic output. 4. **Reduce command-line exposure.** - Prefer an integration where the trusted delivery component constructs the authenticated request internally. - If direct Telegram API access remains necessary, isolate execution from untrusted local users and disable process-command-line collection for the operation where operationally possible. - Review proxy, endpoint-monitoring, and process-accounting systems to ensure URLs containing Telegram tokens are redacted. 5. **Rotate potentially exposed credentials.** - Revoke and regenerate any Telegram bot token that may already have appeared in process-monitoring or diagnostic records. - Review Telegram bot activity and configured chats for unauthorized use. ]]>