Security audit

Create Agent + Telegram Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Telegram agent setup guide, but it under-discloses credential-handling and live service-change risks.

Review this before installing in production. Treat the Telegram bot token as a secret, avoid pasting real tokens into shared terminals or logs, restrict configuration file permissions, rotate any token that may have been exposed, and test the agent binding and gateway restart in a staging environment first.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Telegram Bot Token Exposed Through Command-Line Arguments
Content: View full analysis
.botToken" "" ``` The same pattern appears in the complete example: ```bash openclaw config set "channels.telegram.accounts.judge.botToken" "8764559332:AAGxxx" ``` The example value is masked and is not evidence of an active credential. ### Technical Analysis The documented workflow instructs users to substitute a real Telegram bot token directly into a command-line argument. Depending on the operating environment, the token may be exposed through: - Shell history files. - Process listings or process inspection interfaces while the command is running. - Terminal session logging and command auditing. - Administrative monitoring or diagnostic tooling that records process arguments. A Telegram bot token is a bearer credential. Anyone who obtains it can authenticate to the Telegram Bot API as that bot without needing an additional password. Although the command stores the credential in the intended OpenClaw configuration, placing it directly on the command line unnecessarily expands the number of locations where the credential may be retained or observed. ### Attack Path 1. An operator replaces `` with a real token issued by BotFather. 2. The operator executes the documented `openclaw config set` command. 3. The shell, an audit facility, terminal logging, or process inspection exposes or records the complete command. 4. A local user, compromised process, administrator, or log reader obtains the token. 5. The attacker uses the token to authenticate to the Telegram Bot API. 6. The attacker performs actions permitted to the bot, potentially including reading available updates, sending messages, changing supported bot settings, or impersonating the bo ...[truncated 778 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs operators to handle and persist a Telegram Bot token directly in CLI commands and even shows a realistic token format in examples, but provides no warning that the token is a credential equivalent to account control. This increases the chance of token exposure through shell history, logs, screenshots, shared docs, or insecure config storage, which could let an attacker hijack the bot and impersonate the service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill performs non-interactive agent creation, bot binding, and a gateway restart without warning that these are live system changes that can affect availability and behavior. In operational environments, undocumented restarts and automatic provisioning can cause downtime, misbinding, or unintended exposure of a newly created agent to external Telegram traffic.
Content: No source excerpt is available for this finding.