other
Error
- Location
SKILL.md:19- Finding
Collection of Telegram Authentication Data and External Synchronization of Private Conversations
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Agent Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it advertises, but it asks users to connect Telegram and persist an API key for an external memory service without enough scoping or security guidance.
Install only if you intentionally want a third-party service to index selected Telegram channels or groups. Treat the Agent Memory API key as a secret, avoid pasting it into ordinary chat if a safer secret store is available, limit synced sources and scopes, and confirm that you know how to revoke the Telegram connection, delete synced data, and rotate the key.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:28- Finding
Predictable Temporary File Used to Store and Replace Secret Configuration
- Content
View full analysis
/tmp/oc.json && mv /tmp/oc.json ~/.openclaw/openclaw.json ``` ### Technical Analysis The setup command writes a configuration containing `AGENT_MEMORY_API_KEY` to the fixed path `/tmp/oc.json`. Shared temporary directories are generally writable by other local users, and a predictable filename creates race-condition and link-handling risks. The command does not: - Create the temporary file atomically. - Reject an existing symbolic link or other unexpected file type. - Set a restrictive `umask` or explicit file permissions. - Verify the temporary file's owner. - Preserve or validate the destination file's original permissions. - Validate the generated JSON before replacement. - Create a backup before overwriting the OpenClaw configuration. Shell redirection opens `/tmp/oc.json` before `jq` runs. In an environment where another local user can manipulate the shared temporary directory, an attacker may attempt to pre-position or race the predictable path. In addition, the newly created file's permissions depend on the process umask. Moving that file over `~/.openclaw/openclaw.json` may replace a restrictively permissioned configuration with a more broadly readable file. The API key is embedded directly in the generated configuration. Disclosure of this file therefore gives an attacker a reusable bearer credential. ### Attack Path 1. The victim follows the documented setup instructions on a multi-user system. 2. A local attacker predicts that the command will use `/tmp/oc.json`. 3. The attacker monitors, pre-positions, or races that path, subject to operating-system temporary-directory protections. 4. The setup command wr ...[truncated 1273 chars]- Remediation
View remediation
"$tmp" jq empty "$tmp" chmod 600 "$tmp" mv -f -- "$tmp" "$config" trap - EXIT HUP INT TERM ``` Additional hardening should include: 1. Pass the key through `jq --arg` rather than inserting it into a command template. 2. Avoid putting the secret in shell history or accepting it through ordinary chat where possible. 3. Use the platform's dedicated secret store instead of placing bearer credentials directly in JSON. 4. Verify that the configuration file and parent directory are owned by the current user. 5. Create a permission-preserving backup before replacement. 6. Refuse to operate if the destination is a symbolic link or has unexpected ownership. 7. Ensure the final file is mode `0600` and its parent directory is mode `0700`. 8. Where supported, use OpenClaw's native configuration API rather than shell-based whole-file replacement. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation guidance is broad enough to trigger on generic Telegram-related requests, which can cause the agent to invoke this skill and begin credential-setup flows even when the user did not clearly intend to use this external service. In this context, overbroad activation is risky because the skill connects a personal Telegram account and routes queries to a third-party API, increasing the chance of unintended data exposure or secret solicitation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The setup flow explicitly tells the agent to solicit an API key from the user and operationalize it for future use, which normalizes exposing a secret in plain-language interaction. Because the skill then persists and uses that credential to access Telegram-derived memory, compromise of the key could grant continued access to sensitive conversation data through the external service.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill directs the agent to persist a live API credential across sessions by saving it into OpenClaw configuration, extending the lifetime and exposure window of the secret. Session persistence is especially risky here because the credential enables ongoing access to a service built around private Telegram memory and may be reused automatically without renewed user awareness.
- Content
md When the user asks anything related to Telegram memory, channels, or this skill, and `AGENT_MEMORY_API_KEY` is not configured, walk them through setup: 1. Tell the user: "To use Telegram memory, you need an API key. Open @AgentMemoryBot in Telegram: https://t.me/AgentMemoryBot" 2. In the bot: press /start → 📱 Connect Telegram (share contact, enter reversed code) → 🔑 API Keys → ➕ Create Key 3. Ask the user to paste the key (starts with `amk_`) 4. Once they give you the key, save it to the OpenClaw config:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to collect a user API key and write it into persistent local configuration on disk without warning about storage risks, file permissions, or alternatives. Persisting secrets this way can expose credentials to other local users, backups, logs, or later prompts/tools that read configuration files.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This skill sends user queries and retrieved Telegram-derived context to an external domain, which is an intentional feature but still a real data-transfer risk. Given the service is meant to search and summarize private channel content connected via the user's account, external transmission materially increases sensitivity and requires explicit consent and data-handling safeguards.
- Content
Find information across synced Telegram channels. Use for any question about channel content.
bash curl -s -X POST https://agent.ai-vfx.com/api/v1/memory/search \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $AGENT_MEMORY_API_KEY" \ -d '{"query": "what was discussed about topic X", "scope": "@channel", "limit": 10}'
Static analysis
No suspicious patterns detected.