ClawHub
Back to skill

Security audit

Morning Coffee Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it broadly reads task and memory notes and can automatically send their contents to Telegram without a clear preview, redaction, or confirmation step.

Review this skill before installing. Use it only with task and memory files that are safe to summarize into Telegram, add a preview and redaction step, validate the chat destination, and avoid scheduling it until you are comfortable with what it will send every morning.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:27
Finding
Overbroad Persistent Context Access and External Telegram Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-31, 35-38, and 64-68 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Complete Code Snippet ```markdown ## What It Does 1. Reads your TASKS.md for pending items 2. Reads any memory files (MEMORY.md, projects.md, recent notes) 3. Checks for any urgent blockers or time-sensitive items 4. Synthesizes the top 3 priorities for today 5. Sends a punchy Telegram message you can act on immediately ``` ```markdown ### Step 1: Load Context Read all context files in parallel: - `$TASKS_FILE_PATH` — pending tasks - `{MEMORY_DIR}/MEMORY.md` — long-term context - `{MEMORY_DIR}/projects.md` — active projects (if exists) ``` ```bash curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "{\"chat_id\": \"${TELEGRAM_CHAT_ID}\", \"text\": \"[MESSAGE]\"}" ``` ### Technical Analysis The skill instructs the agent to read complete long-term memory and project files in addition to the task file. This is broader than the minimum access needed to create a daily task briefing. The resulting summary is then transmitted to the Telegram Bot API. No content allowlist, secret-redaction stage, data-classification check, or user confirmation step is specified. Consequently, credentials, private notes, client information, personal data, or unrelated persistent context could be selected as a priority, blocker, or pipeline status and included in the outgoing message. The Telegram delivery feature is declared, so the external communication itself is not hidden. The security issue is the combination of broad persistent-context access and insufficient controls over which portions may leave the local environment. ### Attack Path 1. Sensitive or attacker-influenced information is placed in `MEMORY.md`, `projects.md`, recent notes, or the configured task file. 2. The skill reads the complete contex ...[truncated 1098 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Default to reading only the configured `TASKS_FILE_PATH`. 2. Require explicit configuration and user approval before reading `MEMORY.md`, `projects.md`, or recent notes. 3. Permit only specific approved sections or fields rather than processing complete files. 4. Add a mandatory redaction stage for API keys, tokens, passwords, personal data, client information, and other sensitive values. 5. Generate a local preview and require confirmation before the first transmission or whenever the destination changes. 6. Validate `TELEGRAM_CHAT_ID` against an administrator-approved value rather than accepting an unrestricted environment variable. 7. Document exactly which data categories may be sent to Telegram and exclude unrelated persistent context. 8. Store and process the bot token through an appropriate secret-management mechanism, with restrictive process and environment access. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:64
Finding
Unsafe JSON and Shell Payload Construction for Telegram Messages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64-68 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Complete Code Snippet ```bash curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "{\"chat_id\": \"${TELEGRAM_CHAT_ID}\", \"text\": \"[MESSAGE]\"}" ``` ### Technical Analysis The example constructs JSON through direct textual interpolation inside a shell command. Generated briefing content can contain quotation marks, backslashes, control characters, or newlines originating from task and memory files. Without JSON-aware serialization, these characters can terminate or alter the `text` value and produce malformed or manipulated request bodies. The placeholder `[MESSAGE]` also encourages implementations to substitute generated text directly into shell source. If that substitution occurs before shell parsing, shell metacharacters or command substitutions present in attacker-controlled task content may be interpreted by the shell. Whether local command execution is possible depends on the implementation used to replace the placeholder; malformed JSON and message manipulation remain direct risks when content is not escaped correctly. The same construction provides no structural validation for `TELEGRAM_CHAT_ID`, which should be treated as configuration data rather than embedded directly into hand-built JSON. ### Attack Path 1. An attacker introduces crafted text into a task or memory file processed by the skill. 2. The text contains JSON metacharacters such as quotes, backslashes, or newlines. In an unsafe source-level substitution implementation, it may additionally contain shell syntax. 3. The crafted text is selected for inclusion in the generated briefing. 4. The implementation replaces `[MESSAGE]` directly in the documented command without JSON serialization. 5. The resulting body becomes malformed or has altered JSON ...[truncated 953 chars]
Remediation
<![CDATA[ ## Remediation Suggestions Construct the request using a JSON-aware serializer and keep generated content in data variables rather than shell source. For example: ```bash payload="$( jq -n \ --arg chat_id "$TELEGRAM_CHAT_ID" \ --arg text "$MESSAGE" \ '{chat_id: $chat_id, text: $text}' )" curl --fail-with-body --silent --show-error \ -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` Additional hardening should include: 1. Never use `eval`, dynamically generated shell scripts, or textual command templates to insert briefing content. 2. Validate the chat ID against the expected syntax and an approved destination. 3. Apply a maximum message length before serialization. 4. Treat all task and memory content as untrusted input. 5. Check HTTP status codes and Telegram API error responses instead of using `curl -s` alone. 6. Prevent credentials and sensitive values from being written to logs or error output. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly reads TASKS.md and memory files, then sends a synthesized briefing to Telegram, but it does not warn users that potentially sensitive personal or project information will be transmitted to a third-party service. Even if the message is summarized, task and memory-derived content can still disclose confidential plans, client names, blockers, or operational details.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 4: Send via Telegram

```bash
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "{\"chat_id\": \"${TELEGRAM_CHAT_ID}\", \"text\": \"[MESSAGE]\"}"
```
Confidence
92% confidence
Finding
This command sends generated message content to Telegram's external API, which is a real data egress path from local task and memory files to a third party. Because the message is built from potentially sensitive context, the risk is unintended disclosure of personal, business, or operational information outside the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 4: Send via Telegram

```bash
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "{\"chat_id\": \"${TELEGRAM_CHAT_ID}\", \"text\": \"[MESSAGE]\"}"
```
Confidence
92% confidence
Finding
This command sends generated message content to Telegram's external API, which is a real data egress path from local task and memory files to a third party. Because the message is built from potentially sensitive context, the risk is unintended disclosure of personal, business, or operational information outside the local environment.

Static analysis

No suspicious patterns detected.