ClawHub
Back to skill

Security audit

Telegram Notifier

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Telegram notification helper; it sends user-provided messages to Telegram as advertised, with no hidden code or unrelated behavior found.

Install only if you intend to send selected agent output to Telegram. Do not send secrets, credentials, personal data, regulated data, or full security reports unless you are comfortable with that content leaving the local environment and going to Telegram.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

t:

text
TELEGRAM_BOT_TOKEN=your_bot_token_here
TELEGRAM_CHAT_ID=your_chat_id_here

Get a bot token: Message @BotFather on Telegram → /newbot → copy the token.

Get your chat ID: Message @userinfobot on Telegram → it replies with your ID.

Sending a message

Basic send (plain text)

python
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],
        "text": "Your message here"
    },
    timeout=10
)

Markdown formatted message

python
import os, requests

def send_telegram(text: str, parse_mode: str = "Markdown") -> bool:
    """Send a message to Telegram. Returns True on success."""
    r = requests.post(
        f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
        json={
            "chat_id": os.environ['TELEGRAM_CHAT_ID'],

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description is broadly phrased to send 'any agent report, alert, or message,' which can cause over-invocation on routine reporting tasks. In practice, that increases the chance an agent will route sensitive outputs to Telegram without a deliberate user decision, especially because Telegram is an external third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description mentions Telegram but does not clearly warn that report contents and chat identifiers are transmitted to a third-party service outside the local agent environment. Users or upstream agents may therefore send sensitive findings, credentials, or personal data without understanding the disclosure boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs an outbound HTTPS request to Telegram containing arbitrary message text and a destination chat ID. In the context of an agent skill, any agent-produced content passed into this function can be exfiltrated to an external service, so the danger is unintended disclosure rather than code execution.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

python
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],
        "text": "Your message here"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],
        "text": "Your message here"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
import os, requests

requests.post(
    f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
    json={
        "chat_id": os.environ['TELEGRAM_CHAT_ID'],
        "text": "Your message here"

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The helper function sends arbitrary caller-supplied text to Telegram with Markdown formatting. Because it is reusable and generic, it lowers friction for transmitting sensitive agent outputs externally and can normalize unsafe data sharing in workflows.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
def send_telegram(text: str, parse_mode: str = "Markdown") -> bool:
    """Send a message to Telegram. Returns True on success."""
    r = requests.post(
        f"https://api.telegram.org/bot{os.environ['TELEGRAM_BOT_TOKEN']}/sendMessage",
        json={
            "chat_id": os.environ['TELEGRAM_CHAT_ID'],

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Even though this version includes basic error handling and truncation, it still transmits message content and identifiers to Telegram over the network. The security concern remains that potentially sensitive reports can be sent to a third party without strong safeguards or explicit disclosure in the skill contract.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
return {"ok": False, "error": "TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set"}

    try:
        r = requests.post(
            f"https://api.telegram.org/bot{token}/sendMessage",
            json={"chat_id": chat_id, "text": text[:4096]},  # Telegram limit: 4096 chars
            timeout=10,

Vague Triggers

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The marketing-style statement 'Works with any agent, any report, any workflow' is ambiguous and encourages unconstrained use. That ambiguity can cause an agent to treat the skill as a default sink for outputs, increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.