Crypto Regime Report

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:04 PM UTC
• Version: 1.2.3

Overview

The skill mostly performs the stated crypto market reporting, but it also includes an under-disclosed alert wrapper that reads Telegram credentials and sends alert output externally.

Review this skill before installing. The market-report script itself appears purpose-aligned, but the bundled alert wrapper can read your OpenClaw Telegram bot token/chat ID or TELEGRAM_* environment variables and send generated alert text to Telegram. Install only if you are comfortable with that behavior, use a dedicated low-privilege bot token, and prefer OpenClaw-managed delivery or a local-only report path unless direct Telegram delivery is explicitly intended.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alert_poller.sh:16

Finding

Undeclared OpenClaw Credential Access and Telegram Bot Token Exposure

Content

View full analysis

/dev/null ``` ### Technical Analysis The wrapper directly reads the global OpenClaw configuration file, extracts the Telegram bot token and chat identifier, and performs message delivery itself. This behavior is inconsistent with `SKILL.md`, which states that scripts write reports to standard output and that the agent handles delivery. Report generation and alert evaluation do not require access to the user's global OpenClaw credentials. The wrapper therefore crosses the minimum-privilege boundary established by the declared functionality. The Telegram bot token is also interpolated into curl's URL: ```bash "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" ``` After shell expansion, the complete token becomes part of curl's process arguments. Depending on operating-system process visibility and monitoring configuration, another local process, process-accounting service, diagnostic collec ...[truncated 2465 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the code actually reads local OpenClaw configuration, consumes messaging credentials, and sends Telegram alerts, that materially exceeds the declared scope of generating market reports to stdout. This creates a real risk of credential access and exfiltration of report or query data to external messaging services without clear user awareness, which is especially sensitive in agent ecosystems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the code actually reads local OpenClaw configuration, consumes messaging credentials, and sends Telegram alerts, that materially exceeds the declared scope of generating market reports to stdout. This creates a real risk of credential access and exfiltration of report or query data to external messaging services without clear user awareness, which is especially sensitive in agent ecosystems.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/alert_poller.py (reported line 292)May include surrounding context.

python

alerts.append(f"🔊 *{symbol}*: Volume {vol_ratio:.1f}x avg")
                alert_state["triggered"][alert_key] = vol_key
    
    # Clear states for conditions that no longer exist
    # This allows re-alerting when conditions return
    keys_to_clear = []
    for key in alert_state["triggered"]:

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends poller output to Telegram, which is outside the declared market-report generation scope and creates an undisclosed data egress path. Even if intended for alerting, forwarding generated content off-host can leak trading signals, internal state, or other sensitive output without explicit user awareness or manifest coverage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares executable capabilities via its setup and run instructions (python3, curl, environment-variable driven config) but does not explicitly scope or constrain tool permissions. In an agent environment, missing tool declarations can cause over-broad execution authority, making it easier for the skill to access shell, environment variables, or writable files beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad invocation phrases like 'market report' or 'trend analysis' can cause the skill to trigger on generic financial-analysis requests, expanding its activation surface beyond narrowly intended use. In a multi-skill agent, overbroad matching can route unrelated prompts into a tool that performs network access and code execution, increasing the chance of unintended data disclosure or unnecessary external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation states that the skill uses third-party APIs but does not clearly warn users that watchlist symbols, query context, and timing of scheduled runs will be sent to external services. Lack of disclosure undermines informed consent and can expose user trading interests or operational patterns to third parties.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/alert_poller.py (reported line 65)May include surrounding context.

python

def okx_request(endpoint: str) -> dict:
    url = f"https://www.okx.com{endpoint}"
    result = subprocess.run(
        ["curl", "-s", "--connect-timeout", "10", "--max-time", "30", url],
        capture_output=True, text=True, timeout=35
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/regime_report.py (reported line 69)May include surrounding context.

python

def okx_request(endpoint: str) -> dict:
    url = f"https://www.okx.com{endpoint}"
    result = subprocess.run(
        ["curl", "-s", "--connect-timeout", "10", "--max-time", "30", url],
        capture_output=True, text=True, timeout=35
    )

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The header comments frame the script as a simple wrapper that runs a Python script and sends alerts with 'just curl and Python.' In reality, it also loads Telegram credentials from a user config file and environment variables, which is additional behavior relevant to intent and capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads Telegram credentials from a local OpenClaw config file and environment variables even though the skill description does not indicate it needs messaging secrets. This expands the skill's access to unrelated sensitive data and enables silent use of existing credentials to exfiltrate output to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The hardcoded use of the Telegram API endpoint confirms that this skill sends data to a third-party external service. In a market-analysis skill, undisclosed communication to Telegram is more dangerous because users may assume local analysis/report generation rather than automated outbound dissemination.

Content

Scanner excerpt · scripts/alert_poller.sh (reported line 35)May include surrounding context.

sh

MESSAGE=$(echo "$OUTPUT" | jq -sRr @uri)
        
        # Send to Telegram
        curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
            -d "chat_id=${CHAT_ID}" \
            -d "text=${MESSAGE}" \
            -d "parse_mode=Markdown" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The hardcoded use of the Telegram API endpoint confirms that this skill sends data to a third-party external service. In a market-analysis skill, undisclosed communication to Telegram is more dangerous because users may assume local analysis/report generation rather than automated outbound dissemination.

Content

Scanner excerpt · scripts/alert_poller.sh (reported line 35)May include surrounding context.

sh

MESSAGE=$(echo "$OUTPUT" | jq -sRr @uri)
        
        # Send to Telegram
        curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
            -d "chat_id=${CHAT_ID}" \
            -d "text=${MESSAGE}" \
            -d "parse_mode=Markdown" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits alert output to Telegram without any user-facing disclosure or confirmation at the point of egress. In this skill context, users expect market regime reporting, not necessarily automatic off-host delivery of generated content, so silent transmission increases the chance of unintended data leakage.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example "Run a market report" is not domain-specific on its own and overlaps with everyday requests that could refer to equities, macro markets, or other reporting tasks. Without nearby exclusion criteria, this phrase may activate the skill too broadly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script accesses Telegram credentials from local config and environment without clear disclosure to the user or operator in the skill interface. While credential lookup is not exfiltration by itself, undisclosed secret access is risky because it allows the skill to activate external messaging using ambient credentials the user may not expect it to consume.

Content

No source excerpt is available for this finding.