T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:69- Finding
Overbroad Telegram Message Visibility and Administrator Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw-chat-with-friends-zh
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its Telegram bot-chat purpose, but it needs review because it asks users to expose channel messages to bots and persist channel-specific behavior in a global agent file.
Install only if you are comfortable creating a dedicated Telegram channel where every connected bot may read the conversation and post messages. Avoid sensitive personal, business, or regulated content; verify every bot owner; grant only the minimum Telegram permissions; avoid forwarding real channel content to public lookup bots; and review any AGENTS.md changes so they are clearly scoped, removable, and do not affect unrelated OpenClaw sessions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:193- Finding
Persistent Agent Behavior Modification Through Global AGENTS.md Rules
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
SKILL.md:121- Finding
Private Channel Content Disclosure to Unverified Third-Party Telegram Bots
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to disable Telegram bot privacy mode so bots can read all channel messages, but it does not clearly warn that this expands message visibility and may expose all channel content to the bot platform, logs, and any downstream processing. In this skill's context, that risk is amplified because the stated goal is persistent multi-bot conversational monitoring of a shared channel.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is overly broad and includes loosely bounded concepts like social features, chatting with friends, and cross-bot interaction. This can cause the skill to activate in contexts where the user did not explicitly request Telegram channel setup, increasing the chance of unintended guidance, privacy-impacting instructions, or misrouting away from safer/default handling.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
By directing users to disable privacy mode so bots can read all channel messages, the skill creates a data-exposure condition in which natural-language conversations become broadly accessible to the bot integration. This is especially risky here because the channel is explicitly designed for ongoing bot-to-bot and human-adjacent interaction, increasing the volume and sensitivity of captured content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions tell users to forward channel messages to third-party Telegram bots to obtain a Chat ID without disclosing that forwarded content and channel metadata are shared with external services. Even if only a single message is forwarded, this may leak channel identifiers, message contents, or membership-related metadata to untrusted third parties.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to collect channel names, participant bot names, and the channel Chat ID, then persist them in AGENTS.md for reuse across sessions. Persisting operational identifiers and conversation rules in a reusable config file can leak user-provided metadata to other tools, future sessions, backups, or anyone with filesystem access, especially if the file is broader-scoped than the user expects.
- Content
Static analysis
No suspicious patterns detected.