T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:281- Finding
Telegram Bot Token May Be Exposed in Error Logs
- Content
View full analysis
bool: token = os.getenv("TELEGRAM_BOT_TOKEN") chat_id = os.getenv("TELEGRAM_CHAT_ID") if not token or not chat_id: print("[skill] TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set -- skipping alert.") return False try: resp = requests.post( f"https://api.telegram.org/bot{token}/sendMessage", json={"chat_id": chat_id, "text": message, "parse_mode": "HTML"}, timeout=10, ) resp.raise_for_status() return True except requests.RequestException as exc: print(f"[skill] Telegram send failed: {exc}") return False ``` ### Technical Analysis The Telegram bot token is embedded directly in the request URL. Exceptions raised by `requests` or its underlying networking libraries may include the requested URL, including its path. For this endpoint, that path contains the complete bot token. The exception is converted to a string and printed without sanitization. Consequently, DNS failures, connection failures, proxy errors, TLS errors, redirects, or other request failures may cause the credential-bearing URL to be written to terminal output, container logs, scheduler logs, or OpenClaw execution logs. Using a token in the URL is required by Telegram's Bot API, but logging the raw exception is not required for the Skill's functionality. ### Attack Path 1. The operator configures a valid `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`. 2. An attacker or environmental fault causes the Telegram request to fail, such as by manipulating DNS, proxy configuration, firewall rules, or network availability. 3. The networking library generates an exception containing the requested URL. 4. The Skill prints the unsanitized exception a ...[truncated 678 chars]- Remediation
View remediation