T09 · Insecure Skill Coding Practices
Warning
- Location
memory-template.md:27- Finding
Telegram Bot Token Persisted in Plaintext Configuration Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Bot API
Security checks for vulnerabilities and agentic risk
Overview
This Telegram bot helper is mostly coherent, but it teaches risky token storage and insecure webhook patterns that users should review before installing.
Review before installing. Prefer storing Telegram bot tokens in an environment variable, OS keychain, or secret manager instead of the Markdown memory files. Do not put the bot token in webhook URLs, validate Telegram's secret-token header for every webhook, avoid logging full update payloads, and add explicit consent and retention rules before collecting contacts, locations, or media.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
webhooks.md:198- Finding
Deployable Webhook Examples Accept Unauthenticated Updates
- Content
View full analysis
{ const update = req.body; if (update.message) { const chatId = update.message.chat.id; const text = update.message.text || ''; await axios.post(`${BASE_URL}/sendMessage`, { chat_id: chatId, text: `You said: ${text}` }); } res.json({ ok: true }); }); app.listen(8443); ``` ### Technical Analysis Both primary webhook-server examples trust any JSON body submitted to the public endpoint. They do not validate `X-Telegram-Bot-Api-Secret-Token`, authenticate the source, impose a request-size limit, or apply endpoint-level rate limiting. Although `webhooks.md:136-160` separately demonstrates secret-token verification, the complete Flas ...[truncated 1652 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
webhooks.md:111- Finding
Bot Bearer Credential Embedded in Webhook URL
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
webhooks.md:20- Finding
Complete Telegram Updates and Responses Logged Without Redaction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (89)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
}
text **Always answer the callback:** ```bash curl -X POST "https://api.telegram.org/bot${TOKEN}/answerCallbackQuery" \
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md 1. **Use emojis** — Make buttons visually clear: ✅ ❌ ⬅️ ➡️ 2. **Keep callback_data short** — Max 64 bytes, use IDs not full text 3. **Always answer callbacks** — User sees loading indicator until you respond 4. **Update message on action** — Show feedback by editing the message 5. **Use resize_keyboard** — Reply keyboards look better when resized
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md 1. **Use emojis** — Make buttons visually clear: ✅ ❌ ⬅️ ➡️ 2. **Keep callback_data short** — Max 64 bytes, use IDs not full text 3. **Always answer callbacks** — User sees loading indicator until you respond 4. **Update message on action** — Show feedback by editing the message 5. **Use resize_keyboard** — Reply keyboards look better when resized
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file includes invocation guidance, and the phrase 'User needs to interact with the Telegram Bot API' followed by a wide list of activities is broad enough to match many generic requests. It does not provide explicit trigger phrases, constraints, or negative examples clarifying when this skill should not be selected.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md url = f"https://api.telegram.org/bot{TOKEN}/sendMessage" for attempt in range(max_retries): response = requests.post(url, json={ "chat_id": chat_id, "text": text })
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def api_call(method, **params): response = requests.post( f"https://api.telegram.org/bot{TOKEN}/{method}", json=params )
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Basic Inline Keyboard
bash curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d '{ "chat_id": 123456789,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples include buttons that request sensitive data such as phone number and location, but they provide no warning, consent guidance, data-minimization note, or privacy handling advice. In a bot-development skill, this can normalize collecting personal data without clearly communicating user notice and secure handling expectations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Remove Reply Keyboard
bash curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d '{ "chat_id": 123456789,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill provides concrete examples for uploading and downloading media to Telegram but omits any warning that files and metadata are transmitted to a third-party service. In a bot-development context, this can lead users to send personal, regulated, or sensitive media without considering retention, access controls, consent, or compliance obligations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
By Upload (multipart/form-data)
bash curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \ -F "chat_id=123456789" \ -F "photo=@/path/to/image.jpg" \ -F "caption=Photo caption"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Audio
bash curl -X POST "https://api.telegram.org/bot${TOKEN}/sendAudio" \ -F "chat_id=123456789" \ -F "audio=@song.mp3" \ -F "title=Song Title" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly instructs users to store a Telegram bot token in a local markdown file, which is a poor practice for handling secrets. Markdown files are commonly indexed, synced, committed to version control, or exposed through backups and editor tooling, increasing the chance of accidental credential disclosure and bot takeover.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Long polling to receive updates.
bash curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=${OFFSET}&timeout=30"| Parameter | Required | Description |
Static analysis
No suspicious patterns detected.