T09 · Insecure Skill Coding Practices
- Location
SKILL.md:58- Finding
Hard-Coded Privileged Telegram Bot Token
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:58-62andSKILL.md:90-92
Vulnerability Type: Hard-coded authentication credential
Risk Level: HighVulnerable Code
SKILL.md:58-62:bash curl -X POST "https://api.telegram.org/bot8415787322:AAGK4aQCCGei35g9t2ybKhexlR4BdCZs-3M/sendMediaGroup" \ -F "chat_id=-1003856211981" \ -F 'media=[{"type":"photo","media":"attach://f1","caption":"Текст"},{"type":"photo","media":"attach://f2"}]' \ -F "f1=@/home/larthe/.openclaw/media/inbound/file1.jpg" \ -F "f2=@/home/larthe/.openclaw/media/inbound/file2.jpg"SKILL.md:90-92:bash # Проверить gateway curl -s http://127.0.0.1:18789/health # Проверить бота curl -s "https://api.telegram.org/bot8415787322:AAGK4aQCCGei35g9t2ybKhexlR4BdCZs-3M/getMe"Relevant privilege context is documented at
SKILL.md:84-86:text ✅ Бот имеет **Privacy Mode: Disabled** — видит все сообщения в группах ✅ **groupPolicy: "open"** — может отправлять без упоминания ✅ Бот — админ в группе `-1003856211981`Technical Analysis
A complete Telegram Bot API authentication token is embedded directly in the Skill documentation. Possession of this token is sufficient to authenticate Bot API requests as the associated bot; no additional password or local OpenClaw access is required.
The credential is exposed in both a media-upload example and a bot-status command. Consequently, anyone who can read the Skill package, a copy of the repository, generated documentation, backups, or retained repository history can extract and reuse it independently of the intended OpenClaw workflow.
The documented configuration increases the severity: the bot is described as an administrator of the primary group, as having Privacy Mode disabled, and as operating under an open group policy. The exact effect of compromise depends on the bot's granted Telegram administrator rights and update-delivery configuration, but ...[truncated 1706 chars]
- Remediation
View remediation
Remediation Suggestions
-
Immediately revoke the exposed token through Telegram BotFather and generate a replacement. Merely removing it from the current file is insufficient because existing copies may remain available.
-
Remove the token from
SKILL.md, repository history, release artifacts, documentation, logs, and backups where feasible. -
Store the replacement in a dedicated secret manager or a protected environment variable such as
TELEGRAM_BOT_TOKEN. -
If direct API access remains necessary, construct the endpoint at runtime without recording the token in source-controlled text:
bash test -n "$TELEGRAM_BOT_TOKEN" || { echo "TELEGRAM_BOT_TOKEN is not configured" >&2 exit 1 } curl --fail --show-error --silent \ -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMediaGroup" \ -F "chat_id=${TELEGRAM_CHAT_ID}" \ -F 'media=[{"type":"photo","media":"attach://f1","caption":"Text"},{"type":"photo","media":"attach://f2"}]' \ -F "f1=@${MEDIA_FILE_1}" \ -F "f2=@${MEDIA_FILE_2}" -
Prefer the already configured OpenClaw Telegram channel over exposing raw Bot API authentication in Skill instructions.
-
Restrict access to any secret-bearing configuration file using least-privilege filesystem permissions and ensure it is excluded from version control.
-
Review and minimize the bot's Telegram administrator permissions. Remove administrator status if ordinary posting rights are sufficient.
-
Enable Privacy Mode where operationally feasible and replace the open group policy with an explicit allowlist of approved chats or users.
-
Review Telegram configuration and available logs for unexpected messages, webhook changes, or other activity performed with the exposed credential.
-
Add automated secret scanning to commits and release pipelines to prevent future publication of Telegram tokens and similar credentials.
-