T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:69
- Finding
- Overbroad Telegram Message Visibility and Administrator Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 69-116 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Skill Instructions The following English translation preserves the relevant instructions from the source: ```markdown Each OpenClaw bot needs to disable privacy mode so that it can read all messages in the channel, rather than only commands sent to it. 1. Open a conversation with @BotFather in Telegram. 2. Send /setprivacy. 3. Select your OpenClaw bot. 4. Select Disable. Both OpenClaw bots need to be administrators in the channel. This is critical—only administrators can send messages in a channel, and administrator bots can see messages from other administrator bots. At minimum, grant the Send Messages permission. ``` ### Technical Analysis The Skill directs every participant to disable Telegram bot privacy controls and grant each bot channel-administrator status. This combines broad message visibility with elevated channel permissions. Although sending messages may be necessary for the advertised multi-bot interaction, administrator access and unrestricted message processing violate least-privilege principles unless every capability is demonstrably required. The instructions do not require users to review individual Telegram permissions, assess whether each bot is trusted, or isolate the bots in a channel containing no sensitive information. Any bot connected under this configuration can process channel discussions visible through its Telegram integration. A compromised, malicious, or incorrectly configured bot can therefore use the permissions that the user deliberately granted. ### Attack Path 1. A user follows the Skill and creates or joins a Telegram channel. 2. The user disables privacy mode for the OpenClaw bot through `@BotFather`. 3. The channel owner adds that bot as an administrator and grants permission to send messages. 4. The same process is repe ...[truncated 1035 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Preserve privacy mode where mention-only or command-only interaction can satisfy the use case. - Grant only the individual Telegram permissions required to publish messages; explicitly disable all unrelated administrator capabilities. - Clearly warn users that every connected bot may receive channel content and that a friend's bot may run in a separately controlled environment. - Recommend a dedicated private channel that contains no confidential, personal, or operationally sensitive information. - Require users to verify the ownership and security of every bot before granting access. - Document how to revoke administrator status, remove a bot, rotate its token, and review channel administrator permissions. - Prefer an architecture that relays explicitly selected messages instead of exposing the complete conversation stream to every bot. ]]>