Telegram 自动签到

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.0.0

Overview

The skill is mostly about Telegram bot check-ins, but it also tells users to install a mandatory always-on startup watchdog that keeps an authenticated browser session running.

Install only after reviewing the watchdog section carefully. The normal check-in behavior can be useful, but the mandatory startup service, hard-coded external script path, persistent Telegram cookies, and profile backup/delete commands create real account-session and local persistence risk. Prefer using this only in a dedicated, user-invoked browser profile and avoid enabling the LaunchAgent unless you intentionally want Telegram Web to relaunch at login and after closure.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:111

Finding

Mandatory Always-On LaunchAgent Exceeds the Skill's Functional Requirements

Content

View full analysis

Label ai.openclaw.agent-browser-watchdog ProgramArguments /bin/bash /Users/zq/.openclaw/scripts/agent-browser-watchdog.sh RunAtLoad KeepAlive ``` ```bash launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist launchctl start ai.openclaw.agent-browser-watchdog ``` The instructions also reload the persistent service as follows: ```bash launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist ``` ### Technical Analysis The Skill presents installation of a macOS LaunchAgent watchdog as mandatory. The `RunAtLoad` setting causes execution whenever the user logs in, while `KeepAlive` instructs launchd to restart the process whenever it exits. Telegram check-in is an on-demand browser automation operation. It does not inherently require an always-running background browser, a login-time startup service, or a watchdog that overrides the user's attempt to close the browser. The persistence mechanism therefore exceeds the minimum privileges and lifecycle required for the declared functionality. The persistent browser uses a Chrome profile containing an authenticated Telegram session. Reopening that browser indefinitely increases both the lifetime and exposure of the authenticated session. ### Attack Path 1. A user follows the Skill's mandatory watchdog installation instructions. 2. A LaunchAgent plist is created under the user's `~/Library/LaunchAgents` directory. 3. `launchctl load` registers the service, and `launchctl start` executes it immediately. 4. At subsequent logins, `RunAtLo ...[truncated 880 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:123

Finding

Persistent LaunchAgent Executes an External Mutable Script Not Included in the Skill

Content

View full analysis

ProgramArguments /bin/bash /Users/zq/.openclaw/scripts/agent-browser-watchdog.sh ``` The documented script is an indefinite process that repeatedly launches the browser: ```bash #!/bin/bash BROWSER_URL="${AGENT_BROWSER_URL:-https://web.telegram.org}" CHROME_PROFILE="${AGENT_BROWSER_CHROME_PROFILE:-~/.chrome-profiles/telegram-web}" CHECK_INTERVAL=30 LOG_FILE="/tmp/agent-browser-watchdog.log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE" } is_daemon_running() { pgrep -f "agent-browser-darwin" > /dev/null 2>&1 } start_browser() { log "Starting agent-browser daemon..." agent-browser --profile "$CHROME_PROFILE" open "$BROWSER_URL" > /dev/null 2>&1 & sleep 3 log "agent-browser started (Profile: $CHROME_PROFILE)" } while true; do if ! is_daemon_running; then start_browser fi sleep $CHECK_INTERVAL done ``` ### Technical Analysis The registered LaunchAgent executes `/Users/zq/.openclaw/scripts/agent-browser-watchdog.sh` through Bash, but that script is not included in the audited project. The documentation displays expected contents without creating or verifying the file. Consequently, the behavior that launchd ultimately executes is outside the reviewed package and cannot be guaranteed by this audit. The path is also hard-coded for the user `zq`, making the setup invalid for other users. More importantly, a script in a user's home directory is ordinarily writable by that user. Any process that can modify this file can replace the watchdog with arbitrary shell commands. Because the LaunchAgent has `RunAtLoad` and `KeepAlive` enabled, replacement ...[truncated 1303 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/telegram-signin.sh:6

Finding

Unverified Hard-Coded Telegram UI References Can Operate on the Wrong Conversation

Content

View full analysis

/dev/null 2>&1 agent-browser --session-name "$SESSION_NAME" click e35 2>/dev/null sleep 1 agent-browser --session-name "$SESSION_NAME" fill e90 "/start" 2>/dev/null agent-browser --session-name "$SESSION_NAME" press Enter 2>/dev/null sleep 3 CHECKIN_REF=$(agent-browser --session-name "$SESSION_NAME" snapshot -i 2>&1 | grep "签到" | tail -1 | grep -o 'ref=e[0-9]*' | tail -1 | cut -d'=' -f2) if [ -z "$CHECKIN_REF" ]; then agent-browser --session-name "$SESSION_NAME" screenshot /tmp/checkin-error.png exit 1 fi agent-browser --session-name "$SESSION_NAME" click "e$CHECKIN_REF" ``` ### Technical Analysis The script accepts a bot name through `BOT_NAME`, but never uses it to locate or verify the intended Telegram bot. Instead, it assumes that transient element references `e35` and `e90` correspond to the command keyboard and message input. Such references are generated from the current page state and are not stable identifiers. Telegram layout changes, account differences, notifications, or a different active conversation can cause these references to identify unrelated controls. The script suppresses errors for the fixed-reference interactions, so failures can go unnoticed before subsequent actions proceed. It also presses Enter without confirming that the intended bot conversation is active. There is an additional correctness defect in check-in reference handling. The extraction expression returns a value such as `e28`: ```bash grep -o 'ref=e[0-9]*' | cut -d'=' -f2 ``` The click command the ...[truncated 1599 chars]

Remediation

View remediation

/dev/null`. 7. Restrict check-in-button matching to the verified conversation and expected latest bot message. 8. Correct the malformed reference handling: ```bash CHECKIN_REF=$( agent-browser --session-name "$SESSION_NAME" snapshot -i 2>&1 | grep "签到" | tail -1 | grep -o 'ref=e[0-9]*' | tail -1 | cut -d'=' -f2 ) agent-browser --session-name "$SESSION_NAME" click "$CHECKIN_REF" ``` 9. Prefer the persistent Chrome profile mechanism consistently if authenticated-cookie persistence is part of the declared functionality; the script currently uses `--session-name`, contrary to the Skill's own stated requirements. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The launchd/Watchdog setup establishes system persistence that is not required to perform a Telegram check-in. Persistence mechanisms are security-sensitive because they survive reboots, keep authenticated sessions alive, and can normalize behavior commonly associated with unauthorized automation or post-compromise footholds.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The exact command 'rm -rf ~/.chrome-profiles/telegram-web' is an irreversible destructive action presented as troubleshooting. While not obviously malicious, it is still risky because it deletes persisted browser state and may be copied mechanically by users without understanding the consequences.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

删除 Profile 目录后重新扫码：

bash

rm -rf ~/.chrome-profiles/telegram-web
agent-browser --profile ~/.chrome-profiles/telegram-web --headed open https://web.telegram.org
# 重新扫码登录

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The exact command 'rm -rf ~/.chrome-profiles/telegram-web' is an irreversible destructive action presented as troubleshooting. While not obviously malicious, it is still risky because it deletes persisted browser state and may be copied mechanically by users without understanding the consequences.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

删除 Profile 目录后重新扫码：

bash

rm -rf ~/.chrome-profiles/telegram-web
agent-browser --profile ~/.chrome-profiles/telegram-web --headed open https://web.telegram.org
# 重新扫码登录

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill emphasizes persistent cookies and profile retention but does not warn that the Chrome profile contains sensitive authenticated session data. Users may unknowingly preserve or copy Telegram login state in a way that enables account access by anyone who can read the profile directory.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This duplicate session-persistence finding reflects the same behavior: use of a dedicated on-disk Chrome profile to retain Telegram login state. That convenience comes with the security cost of stored reusable session artifacts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

# 创建 Profile 目录
mkdir -p ~/.chrome-profiles/telegram-web

# 打开浏览器（带 --headed 显示窗口）
agent-browser --profile ~/.chrome-profiles/telegram-web --headed open https://web.telegram.org

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This duplicate session-persistence finding reflects the same behavior: use of a dedicated on-disk Chrome profile to retain Telegram login state. That convenience comes with the security cost of stored reusable session artifacts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

# 创建 Profile 目录
mkdir -p ~/.chrome-profiles/telegram-web

# 打开浏览器(带 --headed 显示窗口)
agent-browser --profile ~/.chrome-profiles/telegram-web --headed open https://web.telegram.org

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's stated purpose is Telegram bot check-in, but it expands into installing a boot-time watchdog that continuously restarts a browser session. This introduces persistence and unattended execution beyond what is necessary for check-in, increasing the risk of covert long-lived sessions, unwanted browser activity, and abuse of authenticated Telegram state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to install a boot-time watchdog that reopens Telegram Web continuously, but it does not clearly warn about the privacy, resource, and persistence implications. Running an authenticated browser automatically at startup broadens exposure and may surprise users or conflict with security expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The launchd plist is part of a persistence mechanism that causes automated browser behavior to survive reboots and relaunchs. Persistence tied to an authenticated Telegram session is a significant security concern because it maintains continuous access and resembles a resident automation foothold.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

安装 Watchdog

bash

# 创建 plist（如果还没有）
cat > ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This plist-based setup contributes directly to boot-time persistence for the browser automation environment. Such persistence is broader than the declared purpose and can keep privileged browser state available without active user awareness.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

bash

# 创建 plist（如果还没有）
cat > ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The documented plist configuration is a persistence artifact that registers the watchdog with launchd. Registering automation to run continuously and restart itself increases stealth, longevity, and the attack surface around stored Telegram session data.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

# 创建 plist（如果还没有）
cat > ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The documented plist configuration is a persistence artifact that registers the watchdog with launchd. Registering automation to run continuously and restart itself increases stealth, longevity, and the attack surface around stored Telegram session data.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

# 创建 plist（如果还没有）
cat > ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The named launch agent formalizes a resident process dedicated to maintaining the browser automation session. This exceeds normal skill functionality and creates a durable background component that could be repurposed or overlooked by users.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

cat > ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>ai.openclaw.agent-browser-watchdog</string>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The persistence configuration is completed and written as a usable launchd plist, enabling the watchdog to run automatically. Even though the line itself is only part of the file, in context it contributes to unattended relaunch behavior tied to an authenticated session.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

<key>StandardErrorPath</key>
    <string>/tmp/agent-browser-watchdog.log</string>
</dict>
</plist>
EOF

# 加载服务（开机自启）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This plist-related instruction is part of enabling persistent autostart through launchd. In context, it is not merely configuration management but activation of a resident mechanism that keeps reopening Telegram Web.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

EOF

# 加载服务（开机自启）
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 立即启动（不等下次开机）
launchctl start ai.openclaw.agent-browser-watchdog

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This plist-related instruction is part of enabling persistent autostart through launchd. In context, it is not merely configuration management but activation of a resident mechanism that keeps reopening Telegram Web.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

EOF

# 加载服务（开机自启）
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 立即启动（不等下次开机）
launchctl start ai.openclaw.agent-browser-watchdog

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The unload command appears in a management section and actually helps disable persistence, but it still reflects the presence of a launchd-based persistent component in the design. The underlying issue is the persistence architecture rather than this specific disable command.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

bash

# 停止 Watchdog（不再自动重启）
launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 重新启动 Watchdog
launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The restart instructions continue to operationalize the persistent launchd watchdog, reinforcing the background autostart behavior. This keeps the authenticated browser automation durable and easy to re-enable, increasing exposure if the host is compromised or shared.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 重新启动 Watchdog
launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 查看 Watchdog 日志

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This plist-linked reload step is another activation point for launchd persistence. It contributes to a resident architecture that is harder for users to reason about and is unnecessary for simple check-in automation.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

# 重新启动 Watchdog
launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 查看 Watchdog 日志
tail -f /tmp/agent-browser-watchdog.log

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This plist-linked reload step is another activation point for launchd persistence. It contributes to a resident architecture that is harder for users to reason about and is unnecessary for simple check-in automation.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

# 重新启动 Watchdog
launchctl unload ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-browser-watchdog.plist

# 查看 Watchdog 日志
tail -f /tmp/agent-browser-watchdog.log

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documented use of 'rm -rf' to delete the profile directory is a destructive local file operation that can remove saved sessions and user data. Although scoped to a specific directory, presenting irreversible deletion as routine troubleshooting without strong warnings can lead to accidental data loss or misuse.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

查看 Profile 目录

bash

ls -la ~/.chrome-profiles/telegram-web/

Profile 备份（可选）

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Backing up and restoring the full browser profile, including cookies, extends the skill from check-in automation into transport and duplication of authenticated session material. This materially increases the risk of session theft, unauthorized reuse, and lateral access if the backup is copied or stored insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The troubleshooting section includes an irreversible deletion command without a clear warning about data loss. Even though the target path is specific, users may not understand that this erases stored sessions and other browser profile data for the automation environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.