T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/telegram-auto-topic.sh:35- Finding
Telegram Bot Token Exposed in Process Command-Line Arguments
- Content
View full analysis
&2 exit 1 fi API="https://api.telegram.org/bot${BOT_TOKEN}" ``` The credential-bearing URL is then passed directly to `curl` for every Telegram API request: ```bash CREATE_RESULT=$(curl -s "$API/createForumTopic" \ -d "chat_id=${CHAT_ID}" \ --data-urlencode "name=${TITLE}") ``` ```bash SEND_RESULT=$(curl -s "$API/sendMessage" \ -d "chat_id=${CHAT_ID}" \ -d "message_thread_id=${TOPIC_ID}" \ --data-urlencode "text=${QUOTED}" \ -d "parse_mode=HTML") ``` ```bash FWD_RESULT=$(curl -s "$API/forwardMessage" \ -d "chat_id=${CHAT_ID}" \ -d "from_chat_id=${CHAT_ID}" \ -d "message_id=${MESSAGE_ID}" \ -d "message_thread_id=${TOPIC_ID}") ``` ### Technical Analysis The script reads the Telegram bot token from the OpenClaw configuration and embeds it in the Bot API URL. That URL is supplied to `curl` as a command-line argument. During request execution, the complete URL—including the bot token—may be visible through operating-system process inspection mechanisms such as `ps`, process-monitoring utilities, or `/proc//cmdline`, subject to the host's process-visibility and access-control settings. Shell tracing, process telemetry, or diagnostic tooling that records command arguments could also retain the credential. This is not a hardcoded credential, and exploitation requires sufficient local process-observation access. Nevertheless, passing a reusable secret in process arguments unnecessarily expands its exposure beyond the protected configuration file. ### Attack Path 1. The Skill receives a `/topic` request and invokes `telegram-auto-topic.sh`. 2. T ...[truncated 1525 chars]- Remediation
View remediation