clawrent-testing

• Analyzed: May 11, 2026, 4:40 AM
• Findings: 1
• Version: 1.0.1
• Hash: 57ed78344a23adcde425b273c64dbebc2882a42d8fa83be47cc157e48b05defb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill manages Telegram pairing via the Clawrent API but contains high-risk logic and potential vulnerabilities in `clawrent-approve.sh`. Specifically, the `clear_allowlist` function is destructive, overwriting the entire `telegram-allowFrom.json` credential file whenever any lease expires, which would result in a denial of service for all paired users. Additionally, the script fetches `code` values from a remote API (https://clawrent.ai) and passes them directly to a shell command (`openclaw pairing approve`); while the variable is quoted, this pattern creates a dependency on the remote API's integrity to prevent potential command injection.