T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:58
- Finding
- Hard-Coded Privileged Telegram Bot Token## Vulnerability Details **File Location**: `SKILL.md:58-62` and `SKILL.md:90-92` **Vulnerability Type**: Hard-coded authentication credential **Risk Level**: High ### Vulnerable Code `SKILL.md:58-62`: ```bash curl -X POST "https://api.telegram.org/bot8415787322:AAGK4aQCCGei35g9t2ybKhexlR4BdCZs-3M/sendMediaGroup" \ -F "chat_id=-1003856211981" \ -F 'media=[{"type":"photo","media":"attach://f1","caption":"Текст"},{"type":"photo","media":"attach://f2"}]' \ -F "f1=@/home/larthe/.openclaw/media/inbound/file1.jpg" \ -F "f2=@/home/larthe/.openclaw/media/inbound/file2.jpg" ``` `SKILL.md:90-92`: ```bash # Проверить gateway curl -s http://127.0.0.1:18789/health # Проверить бота curl -s "https://api.telegram.org/bot8415787322:AAGK4aQCCGei35g9t2ybKhexlR4BdCZs-3M/getMe" ``` Relevant privilege context is documented at `SKILL.md:84-86`: ```text ✅ Бот имеет **Privacy Mode: Disabled** — видит все сообщения в группах ✅ **groupPolicy: "open"** — может отправлять без упоминания ✅ Бот — админ в группе `-1003856211981` ``` ### Technical Analysis A complete Telegram Bot API authentication token is embedded directly in the Skill documentation. Possession of this token is sufficient to authenticate Bot API requests as the associated bot; no additional password or local OpenClaw access is required. The credential is exposed in both a media-upload example and a bot-status command. Consequently, anyone who can read the Skill package, a copy of the repository, generated documentation, backups, or retained repository history can extract and reuse it independently of the intended OpenClaw workflow. The documented configuration increases the severity: the bot is described as an administrator of the primary group, as having Privacy Mode disabled, and as operating under an open group policy. The exact effect of compromise depends on the bot's granted Telegram administrator rights and update-delivery configuration, but ...[truncated 1706 chars]
- Remediation
- ## Remediation Suggestions 1. Immediately revoke the exposed token through Telegram BotFather and generate a replacement. Merely removing it from the current file is insufficient because existing copies may remain available. 2. Remove the token from `SKILL.md`, repository history, release artifacts, documentation, logs, and backups where feasible. 3. Store the replacement in a dedicated secret manager or a protected environment variable such as `TELEGRAM_BOT_TOKEN`. 4. If direct API access remains necessary, construct the endpoint at runtime without recording the token in source-controlled text: ```bash test -n "$TELEGRAM_BOT_TOKEN" || { echo "TELEGRAM_BOT_TOKEN is not configured" >&2 exit 1 } curl --fail --show-error --silent \ -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMediaGroup" \ -F "chat_id=${TELEGRAM_CHAT_ID}" \ -F 'media=[{"type":"photo","media":"attach://f1","caption":"Text"},{"type":"photo","media":"attach://f2"}]' \ -F "f1=@${MEDIA_FILE_1}" \ -F "f2=@${MEDIA_FILE_2}" ``` 5. Prefer the already configured OpenClaw Telegram channel over exposing raw Bot API authentication in Skill instructions. 6. Restrict access to any secret-bearing configuration file using least-privilege filesystem permissions and ensure it is excluded from version control. 7. Review and minimize the bot's Telegram administrator permissions. Remove administrator status if ordinary posting rights are sufficient. 8. Enable Privacy Mode where operationally feasible and replace the open group policy with an explicit allowlist of approved chats or users. 9. Review Telegram configuration and available logs for unexpected messages, webhook changes, or other activity performed with the exposed credential. 10. Add automated secret scanning to commits and release pipelines to prevent future publication of Telegram tokens and similar credentials.