ClawHub
Back to skill

Security audit

Session Monitor

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed session monitor, but it needs Review because it can continuously forward unredacted agent transcript excerpts to Telegram and includes auto-restart persistence guidance.

Install only if every monitored session owner expects their activity to be forwarded to the configured Telegram chat. Treat the destination chat and bot token as sensitive, avoid the HEARTBEAT.md watchdog unless persistent monitoring is explicitly required, and assume prompts, responses, commands, filenames, URLs, and tool outputs may be exposed without redaction.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:33
Finding

Persistent Auto-Restart Watchdog for Session Monitoring

Content
View full analysis
/dev/null) if [ -z "$PID" ] || ! ps -p "$PID" > /dev/null 2>&1; then cd scripts && node index.js > monitor.log 2>&1 & fi ``` ### Technical Analysis The Skill explicitly instructs the agent to place an auto-restart watchdog in `HEARTBEAT.md`. Unlike a foreground monitor limited to the initiating task, this hook is intended to execute during later heartbeat cycles and restart the monitor whenever its process is missing. This creates cross-session persistence. Process termination or cleanup does not reliably stop the monitoring capability because a subsequent heartbeat can launch it again. The relaunched process then resumes polling session transcripts and sending formatted data to Telegram. ### Attack Path 1. The user or agent follows the Skill instructions and adds the supplied watchdog to `HEARTBEAT.md`. 2. The monitor starts as a detached background process. 3. The original execution session ends, or the monitor is terminated by cleanup. 4. A later heartbeat evaluates the persistent watchdog. 5. The watchdog reads the PID file and determines that the monitor is absent. 6. It launches `node index.js` again in the background. 7. Transcript monitoring and Telegram transmission resume without a new invocation of the Skill. ### Impact Assessment The watchdog can preserve the monitor across execution-session boundaries and repeatedly restore it after termination. Its effective privileges are those of the account processing `HEARTBEAT.md`, including access to every configured session directory and permission to transmit data using the configured Telegram bot. T ...[truncated 195 chars]
Remediation
View remediation

other

Error
Location
scripts/index.js:29
Finding

Unredacted Export of Private Agent Session Data to Telegram

Content
View full analysis
f.endsWith('.jsonl') && !f.includes('.deleted.')); } catch { continue; } for (const f of files) { const fp = path.join(dir, f); const prev = sizes.get(fp) || 0; let size; try { size = fs.statSync(fp).size; } catch { continue; } if (!prev) { sizes.set(fp, size); continue; } if (size <= prev) { sizes.set(fp, size); continue; } try { const fd = fs.openSync(fp, 'r'); const buf = Buffer.alloc(size - prev); fs.readSync(fd, buf, 0, buf.length, prev); fs.closeSync(fd); sizes.set(fp, size); const sid = path.basename(fp, '.jsonl'); const tag = getTag(sid, agentName); for (const raw of buf.toString('utf8').split('\n')) { if (!raw.trim()) continue; try { const e = parse(JSON.parse(raw)); if (e) { if (!newEntries.has(tag)) newEntries.set(tag, []); newEntries.get(tag).push(e); } } catch {} } } catch { sizes.set(fp, size); } } } ``` Assistant text and tool-call processing in `scripts/parser.js:238-264`: ```js if (msg.role === 'assistant') { const content = Array.isArray(msg.content) ? msg.content : []; const tools = content.filter(c => c.type === 'toolCall').map(summarizeTool); const model = shortModel(msg.model); const text = content .filter(c => c.type === 'text' && c.text) .map(c => c.text).join(' ').trim() .replace(/\n/g, ' ').replace(/\s+/g, ' ') .replace(/\[\[reply_to_current\]\]/g, '\x00REPLY\x00') .replace(/\[\[reply_to:[^ ...[truncated 3336 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/formatter.js:38
Finding

Telegram HTML Injection Through Unescaped Session Metadata

Content
View full analysis
tagOrder(a[0]) - tagOrder(b[0])); const parts = []; for (const [tag, entries] of sorted) { // find last model used in this session let model = null; for (let i = entries.length - 1; i >= 0; i--) { if (entries[i].model) { model = entries[i].model; break; } } const merged = mergeMessages(entries); const body = merged.join('\n'); const header = model ? `${tag} ${model}
Remediation
View remediation
String(value) .replace(/&/g, '&') .replace(//g, '>'); const safeTag = esc(tag); const safeModel = model ? esc(model) : null; const header = safeModel ? `${safeTag} ${safeModel}` : `${safeTag}`; ``` - Prefer Telegram entities or plain-text messages over hand-built HTML where practical. - Validate display names and labels against a conservative length and character policy. - Add tests using labels and model names containing `<`, `>`, `&`, quotes, nested tags, malformed tags, and Telegram link markup. - Treat rendering failures as observable errors without silently losing subsequent monitor updates. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a full live monitoring system for agent sessions with Telegram notifications and background-process control. The supplied code does not implement monitoring logic. It reads local session metadata files, derives labels from filenames/content, formats display tags, and exposes session directories. These behaviors are consistent with a supporting utility for a monitoring system, but not with the declared primary purpose itself. There is no code for tailing JSONL transcripts continuously, observing live session updates, sending Telegram messages, or managing a daemon/background monitor. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code chunk is materially narrower than the declared description. It performs offline inspection of existing JSONL session files by reading them once, taking the last 10 lines, parsing and formatting them, and printing the result. There is no evidence of continuous watching, daemon/background execution, Telegram API usage, push delivery, dashboarding, or control commands for restarting/stopping/checking a monitor. While it is related to session transcript processing, its actual role appears to be a dry-run/test utility rather than the declared real-time monitoring service.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The wording explicitly promotes surveillance-style use cases, including 'spy on agent' and subscription-style activity tracking. That framing normalizes covert monitoring and raises the likelihood of misuse for unauthorized observation of conversations or agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill prominently advertises live monitoring and Telegram delivery but does not present a strong privacy warning that user and assistant transcript contents will be sent to an external chat service. Users may enable it without understanding that potentially sensitive conversations, tool outputs, or identifiers are being exported outside the local environment.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The core design continuously forwards full agent session transcripts to Telegram, an external third-party messaging platform. This creates a direct exfiltration path for sensitive prompts, responses, tool outputs, personal data, and operational details, and the monitoring context makes that risk central rather than incidental.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
node scripts/index.js > scripts/monitor.log 2>&1 &

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
node scripts/index.js > scripts/monitor.log 2>&1 &

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
// config.js — Load configuration from .env file (multi-agent support)
const fs = require('fs');
const path = require('path');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
// config.js — Load configuration from .env file (multi-agent support)
const fs = require('fs');
const path = require('path');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
// config.js — Load configuration from .env file (multi-agent support)
const fs = require('fs');
const path = require('path');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
// config.js — Load configuration from .env file (multi-agent support)
const fs = require('fs');
const path = require('path');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.js (reported line 1)May include surrounding context.

js
// config.js — Load configuration from .env file (multi-agent support)
const fs = require('fs');
const path = require('path');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.js (reported line 6)May include surrounding context.

js
const path = require('path');

function loadEnv() {
  const envPath = path.join(__dirname, '.env');
  try {
    const lines = fs.readFileSync(envPath, 'utf8').split('\n');
    for (const line of lines) {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities involving environment-based secrets and operational behaviors, but it declares no explicit tool scope or permission boundaries. In a skill that reads local session transcripts and forwards them externally, missing scope constraints increases the chance of unintended execution with broader-than-necessary access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is extremely broad and includes terms like 'watch,' 'track,' 'observe,' and especially 'spy on agent,' which can cause the skill to activate in situations where the user did not intend continuous exfiltrating monitoring. Because the skill forwards transcript data to Telegram, accidental invocation materially increases privacy and data leakage risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly instructs users to run the monitor as a background process and even add a watchdog in HEARTBEAT.md to auto-restart it. Persistence is dangerous here because the process continuously monitors and exports transcript data, making unauthorized or forgotten monitoring more likely to continue indefinitely.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

node scripts/index.js > scripts/monitor.log 2>&1 &

text

⚠️ **Agent exec sessions:** Processes started via `nohup &` inside an
agent's `exec` tool may be killed when the exec session is cleaned up.
Add a watchdog to your HEARTBEAT.md to auto-restart:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code continuously tails session transcript files and pushes their contents to Telegram, an external messaging service, as a persistent background monitor. In the skill context, this materially increases risk because it enables ongoing exfiltration of potentially sensitive agent activity, credentials, prompts, or user data without any consent, access-control, or minimization logic visible in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code sends session update content to the Telegram Bot API over the network with no consent check, disclosure mechanism, redaction, or destination validation in the sender path. In the context of a background session monitor explicitly designed to watch agent activity and push live updates, this creates a meaningful exfiltration risk because potentially sensitive transcript data can be forwarded off-system to an external chat service without user awareness at the point of transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest frames this skill as monitoring JSONL session transcripts and pushing updates to Telegram, but this file also implements generic secret/config ingestion from process environment and a local .env file. While BOT_TOKEN and CHAT_ID are expected for Telegram delivery, loading arbitrary keys from .env and exposing additional user/group mapping configuration extends into credential/config management that is not explicitly described in the skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The script writes a .pid file on startup and deletes it on exit, which is a filesystem-modifying operation. While the nearby comment labels it as a PID file, there is no user-facing warning, confirmation, or visible logging that the skill will create and remove a file in its own directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The file imports BOT_TOKEN, which is a credential used to authenticate outbound Telegram API requests, but there is no warning or explanatory comment about handling or using sensitive credentials. The rule calls for flagging access to sensitive environment variables or credentials when no disclosure is present.

Content

No source excerpt is available for this finding.