ClawHub
Back to skill

Security audit

Telegram Notifier

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Telegram notification skill, but users should avoid sending secrets or private reports through it unintentionally.

Install only if you want agent-generated content sent to the configured Telegram chat. Use a dedicated bot and chat, keep the bot token secret, review or redact sensitive reports before sending, and add the cron example only if recurring notifications are intended.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The description is broad enough that an agent could invoke this skill for many kinds of reports, alerts, or messages without an explicit user confirmation step. In a system where agents may handle sensitive data, broad activation language increases the chance of unintended exfiltration to Telegram.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill description advertises sending reports and alerts to Telegram but does not prominently warn that message contents leave the local environment and are transmitted to a third-party service. This omission can cause users or agents to send sensitive findings, credentials, incident details, or regulated data off-platform without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],
Confidence
93% confidence
Finding
This code performs an external network transmission to Telegram, which is the core function of the skill. While not inherently malicious, it is security-relevant because any supplied report content is sent outside the local trust boundary and may include sensitive information.

External Transmission

Medium
Category
Data Exfiltration
Content
def send_telegram(text: str, parse_mode: str = "Markdown") -> bool:
    """Send a message to Telegram. Returns True on success."""
    r = requests.post(
        f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
        json={
            "chat_id": os.environ['TELEGRAM_CHAT_ID'],
Confidence
93% confidence
Finding
The helper function sends arbitrary text to Telegram, making it easy for downstream callers to forward sensitive or unreviewed agent output externally. The inclusion of Markdown formatting also encourages rich report delivery, which increases the likelihood of sharing operationally sensitive details.

External Transmission

Medium
Category
Data Exfiltration
Content
return {"ok": False, "error": "TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set"}

    try:
        r = requests.post(
            f"https://api.telegram.org/bot{token}/sendMessage",
            json={"chat_id": chat_id, "text": text[:4096]},  # Telegram limit: 4096 chars
            timeout=10,
Confidence
91% confidence
Finding
Even in the error-handling example, the function transmits message content to Telegram, preserving the same data exfiltration risk as the earlier snippets. The safer error handling does not mitigate the fact that arbitrary content leaves the environment.

Static analysis

No suspicious patterns detected.