ClawHub
Back to skill

Security audit

Telegram E2E (Userbot)

Security checks for vulnerabilities and agentic risk

Overview

The scanners mark this skill suspicious because it appears to use a mock test path despite being described as testing real-user behavior on Telegram's Test Server; the review is based on medium-confidence, incomplete evidence.

Treat this as a review decision, not a claim of malicious intent. Before installing, consider whether a mock-based workflow fits your needs and whether the stated live-server testing and credential handling are verifiable. Coverage is incomplete: several referenced scripts or paths were unavailable, so the scanners could not confirm their behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The explicit '--backend mock' option and mock-port configuration establish a materially different verification environment from the declared real-user Telegram Test Server workflow. Recording results, generating scenario files, and restarting the gateway are reasonable supporting test operations, not independent mismatches. The supplied chunk does not establish actual Test Server access or Convex credential leasing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Recording events and summaries supports the declared testing purpose, but the selected runner and explicit mock-port argument indicate a materially different testing environment from the promised real Telegram Test Server workflow. The invoked script's implementation is not supplied, so its internal behavior cannot be verified; the visible chunk does not substantiate the declared live-server and credential-leasing behavior.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · features/README.md (reported line 119)May include surrounding context.

responses use { method, at, doneAt, status, updates } with only the update count; empty long-poll responses stay unlogged. File downloads appear as log-only file rows without paths; hold/reject controls do not match them. The log can show that no call reached Telegram inside a flood window.

json
{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · features/runtime-reference.md (reported line 382)May include surrounding context.

md
- TDLib replays cached updates after connect; judge only events after the run's sent action.
- The driver pins `@prebuilt-tdlib` `0.1008067.0`, which reports TDLib `1.8.67`.
- TDLib 1.8.6 and later take the existing base64 database key in `setTdlibParameters`; re-encoding changes the key.
- Credential readiness calls `https://api.telegram.org/bot<TOKEN>/test/<method>` directly; the standalone doctor never starts a local adapter. The full SUT still uses the loopback adapter because OpenClaw does not expose grammY's Test Server option. That adapter also owns scenario hold/reject controls; Gateway health checks and the mock provider still need local HTTP access. Do not bypass host egress policy to run them.
- Broker calls time out after 15 seconds. A failed heartbeat fences the runner before later actions and stops an active probe.
- Chunked broker payloads are authenticated per chunk and bounded to 64 MiB and 4096 chunks before JSON parsing.
- Scope gateway logs with `logging.file`; the