T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:184- Finding
Telegram Bot Token May Be Disclosed Through Exception Logging
- Content
View full analysis
bool: token = os.getenv("TELEGRAM_BOT_TOKEN") chat_id = os.getenv("TELEGRAM_CHAT_ID") if not token or not chat_id: print("[skill] TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set — skipping alert.") return False try: resp = requests.post( f"https://api.telegram.org/bot{token}/sendMessage", json={"chat_id": chat_id, "text": message, "parse_mode": "HTML"}, timeout=10, ) resp.raise_for_status() return True except requests.RequestException as exc: print(f"[skill] Telegram send failed: {exc}") return False ``` ### Technical Analysis The Telegram bot token is embedded directly in the request URL. Exceptions produced by `requests`, including HTTP errors raised by `raise_for_status()`, can include the complete request URL in their string representation. The exception is printed without sanitization. Consequently, a failure response, proxy error, timeout, TLS error, or other request exception may place the token-bearing URL in stdout. In managed OpenClaw deployments, stdout may be retained by container logs, process supervisors, CI systems, or centralized monitoring. Using the token in the Telegram Bot API URL is required by Telegram's API design, but logging a potentially token-bearing exception is not required for this Skill's functionality and exceeds minimum credential exposure. ### Attack Path 1. The Skill runs with a valid `TELEGRAM_BOT_TOKEN`. 2. Telegram delivery experiences an HTTP failure, timeout, proxy failure, TLS error, or deliberately induced network disruption. 3. `requests` raises a `RequestException` whose text includes the request URL. 4. The exception handler prints the unsanitiz ...[truncated 799 chars]- Remediation
View remediation