T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli-cheatsheet.md:17- Finding
Telegram Bot Token Exposed Through Command-Line Arguments
- Content
View full analysis
``` ### Technical Analysis The documented command instructs users to provide a Telegram bot token directly as a command-line argument. When the placeholder is replaced with an actual token, the secret can be exposed through: - Shell history files if the command is entered interactively. - Process inspection utilities while the command is running. - Operating-system auditing and endpoint-monitoring logs. - Terminal session recording or command telemetry. - Diagnostic output that captures the invoked command. Command-line arguments are not an appropriate secret-transfer mechanism because they may be observable by systems and principals other than the intended process. ### Attack Path 1. An administrator follows the documented procedure and replaces `` with a valid Telegram bot token. 2. The command containing the token is recorded in shell history, terminal telemetry, audit logs, or process information. 3. A local user, support operator, monitoring service, or attacker with access to those records retrieves the token. 4. The attacker uses the token against the Telegram Bot API. 5. The attacker can impersonate or operate the affected bot within the permissions and functionality granted to that bot. ### Impact Assessment Exposure grants control associated with the compromised Telegram bot token. Depending on the bot configuration, an attacker may send messages as the bot, inspect available bot updates, disrupt legitimate operation, or interact with OpenClaw workflows connected to the bot. The impact is limited to the affected bot and any downstream systems that trust its messages, but those downstream integrations may expand the practical scope. ]]>- Remediation
View remediation