openclaw-chat-with-friends-cn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:59 PM UTC
• Version: 1.0.1

Overview

This skill is coherent for setting up OpenClaw bots in Telegram, but it asks users to broaden bot message access and share channel details without enough privacy safeguards.

Install only if you are comfortable using a dedicated Telegram channel and dedicated bots for this feature. Do not discuss sensitive information in that channel, avoid using bots that are also present in other groups, prefer OpenClaw or Telegram first-party Chat ID discovery, and do not commit AGENTS.md with channel IDs or bot rules to a public/shared repository.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:67
• Finding: Unnecessary Disabling of Telegram Bot Privacy Mode Expands Message Access## Vulnerability Details **File Location**: `SKILL.md`, lines 67-83 **Vulnerability Type**: Excessive access to Telegram message content **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English rendering of the relevant instruction segment: ```markdown ## Step 2: Configure Bot Privacy Mode Through BotFather Every OpenClaw bot needs to disable privacy mode so that it can read all messages in the channel, rather than only commands sent to it. Steps: 1. Open the conversation with @BotFather in Telegram. 2. Send /setprivacy. 3. Select your OpenClaw bot. 4. Select Disable. Explain why this matters: by default, Telegram bots can only see messages beginning with / or messages that directly mention them. After privacy mode is disabled, the bot can see every message in the channel. Important: the user's friend must do the same for their OpenClaw bot. Privacy mode must be disabled for both bots. ``` Related context-access rules at lines 183 and 217 instruct each bot to read the ten most recent messages. ### Technical Analysis The Skill categorically instructs every participant to disable Telegram bot privacy mode. This changes a bot-level security setting and can broaden message delivery beyond explicit commands and direct mentions, particularly when the bot is used in Telegram groups in addition to the intended channel. The setting is not scoped exclusively to the channel established by this Skill. Consequently, a bot reused elsewhere may receive message content from other conversations after the setting is changed. The Skill does not require participant consent, identify retention boundaries, restrict processing to explicit triggers, or explain how users should restore the setting. Moreover, Telegram privacy mode primarily controls message visibility in groups; channel administrators receive channel posts through Telegram's channel update mechanism. Requiring this global reduction ...[truncated 1598 chars]
• Remediation: ## Remediation Suggestions 1. Do not require privacy mode to be disabled by default. 2. Explain that privacy mode affects group message delivery at the bot level and is not restricted to one channel. 3. Verify whether channel administrator updates already satisfy the integration requirements before weakening privacy settings. 4. Prefer explicit activation through mentions, commands, replies, or an allowlisted channel identifier. 5. Require an allowlist of permitted chat IDs in OpenClaw and reject updates from all other chats. 6. Obtain informed consent from every participant before processing general conversation content. 7. Minimize retained context and document whether messages are logged, transmitted to model providers, or stored by integrations. 8. If disabling privacy mode is genuinely required, recommend a dedicated bot that is not present in unrelated groups. 9. Include rollback instructions for re-enabling privacy mode when the integration is removed. 10. Treat all Telegram messages as untrusted input and prevent message content from authorizing tool calls, configuration changes, credential disclosure, or persistent instruction updates.

other

Warning

• Location: SKILL.md:113
• Finding: Private Channel Messages May Be Disclosed to Unverified Third-Party Bots## Vulnerability Details **File Location**: `SKILL.md`, lines 113-118 **Vulnerability Type**: Third-party data and metadata disclosure **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English rendering of the relevant instruction segment: ```markdown ## Step 4: Connect the Channel to OpenClaw 1. Obtain the channel Chat ID using one of several methods: - Forward any message from the channel to @userinfobot or @getidsbot. It will return the channel Chat ID, usually a negative number such as -100xxxxxxxxxx. - Alternatively, check whether the OpenClaw panel or settings provide automatic detection of joined channels. ``` ### Technical Analysis The Skill recommends forwarding an arbitrary channel message to either `@userinfobot` or `@getidsbot`. These are external Telegram accounts whose operators, source code, retention practices, access controls, and privacy policies are not established anywhere in the project. Forwarding a message may expose its content and associated metadata to the external bot. Depending on Telegram's forwarding behavior and the channel's forwarding restrictions, this may include the channel identity, source attribution, message identifiers, timestamps, or other contextual information. Even where source attribution is hidden, the message body is still deliberately transmitted to a third party. The instruction says to forward “any message” and does not require the use of a purpose-created, non-sensitive test message. It also presents the external bots before the safer local or first-party alternative. ### Attack Path 1. A user creates or joins a private Telegram channel containing confidential conversation. 2. Following the Skill, the user forwards an existing channel message to one of the named third-party bots. 3. The third-party bot receives the forwarded content and any metadata Telegram attaches to it. 4. The bot operator can log, profil ...[truncated 995 chars]
• Remediation: ## Remediation Suggestions 1. Remove unverified third-party lookup bots from the primary setup procedure. 2. Obtain the chat ID through Telegram's official Bot API, such as by inspecting an authenticated `getUpdates` response or a locally controlled webhook event after posting a test message. 3. Prefer OpenClaw's own channel-discovery mechanism when it processes data locally or through an explicitly trusted service. 4. If a third-party bot remains an optional method, clearly disclose that forwarded content and metadata leave the private channel's trust boundary. 5. Require users to create and forward a non-sensitive test message rather than an arbitrary existing message. 6. Instruct users to review the third party's operator identity, privacy policy, retention practices, and account authenticity before use. 7. Do not forward credentials, bot tokens, invitation links, personal information, or confidential conversation. 8. Validate the returned chat ID against a locally observed Telegram update before storing or using it.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: 文档明确指导用户关闭 Telegram 机器人隐私模式，使机器人能够读取频道中的全部消息，但没有同步给出显著的隐私、同意和数据最小化警告。这会让用户和其朋友的机器人获得对频道内容的广泛可见性，一旦频道中出现敏感信息、第三方内容或未充分知情的参与者消息，就可能造成超范围收集与意外泄露。

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: 技能描述中的触发条件覆盖了“和朋友聊天”“社交功能”“跨机器人互动”等较宽泛表述，容易与普通社交/聊天类请求重叠，导致在非预期场景下被调用。误触发本身不一定直接造成入侵，但会把用户带入外部平台配置、机器人连接和持久化规则设置流程，扩大隐私暴露和误操作面。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: 文档要求把频道规则、机器人身份和 Chat ID 持久化写入 AGENTS.md，却未提醒这些信息会长期保存在本地文件中，并可能进入备份、版本控制、日志或被其他本地用户读取。虽然 Chat ID 不一定等同于密钥，但它与频道元数据、机器人名称和行为规则结合后，会增加系统结构暴露、被误分享或被滥用于定向配置攻击的风险。

Static analysis

No suspicious patterns detected.