openclaw-chat-with-friends

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:57 PM UTC
• Version: 1.0.0

Overview

This is a coherent Telegram setup guide, but it under-warns users about private channel data exposure to bots and third-party Telegram helpers.

Install only if you are comfortable giving the OpenClaw bots admin rights and letting them read channel messages. Use a dedicated private channel, get consent from participants, avoid forwarding real channel messages to third-party helper bots, and prefer OpenClaw or Telegram Bot API methods under your control to obtain the Chat ID.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:114
• Finding: Private Channel Content and Metadata Disclosure to Third-Party Telegram Bots## Vulnerability Details **File Location**: `SKILL.md`, lines 114–118 **Vulnerability Type**: Disclosure of private channel data to unverified third-party services **Risk Level**: Medium **Vulnerable snippet**: ```markdown Steps to relay: 1. Get the channel's **Chat ID**. There are a few ways: - Forward any message from the channel to the bot **@userinfobot** or **@getidsbot** — it will report the channel's chat ID (usually a negative number like `-100xxxxxxxxxx`). - Or check your OpenClaw dashboard/settings if it provides a way to detect channels the bot is already in. ``` ### Technical Analysis The skill instructs users to forward a Telegram channel message to one of two third-party bots to obtain the channel ID. This operation may disclose the forwarded message body, forwarding attribution, channel identity, and related Telegram metadata to an external service whose ownership, data-retention policy, and trustworthiness are not established by the project. The instruction does not warn users about the disclosure, require informed consent, or limit the forwarded content to a newly created non-sensitive test message. This is particularly significant because the skill recommends private channels elsewhere in the document. The channel ID can instead be obtained through a trusted OpenClaw interface or Telegram Bot API data under the user's control, making third-party disclosure unnecessary. No evidence indicates that the named bots are malicious. The vulnerability is the unsafe recommendation to transmit potentially sensitive channel data to unverified third parties without adequate safeguards. ### Attack Path 1. A user creates or joins a Telegram channel, potentially configured as private. 2. The user follows the skill and selects an existing channel message. 3. The user forwards that message to `@userinfobot` or `@getidsbot`. 4. The third-party bot receives the forwarded content and any metadata Telegram exposes ...[truncated 1124 chars]
• Remediation: ## Remediation Suggestions 1. Remove the recommendation to forward channel messages to third-party Telegram bots. 2. Prefer trusted methods under the user's control, such as: - Reading the chat ID from OpenClaw's channel configuration or event logs. - Obtaining the ID from Telegram Bot API updates received by the user's own bot. - Using an authenticated administrative interface operated by the user or OpenClaw. 3. If the third-party method must remain as a fallback: - Clearly identify the recipients as external services. - Warn that forwarding may disclose message content and channel metadata. - Require explicit user consent before recommending the operation. - Instruct the user to create and forward a new, non-sensitive test message rather than an existing conversation. - Advise the user to review the third party's ownership, privacy policy, and retention practices. - Present the method only after trusted alternatives have failed. 4. Minimize disclosure by documenting a procedure that retrieves only the numeric chat ID without transmitting conversation content.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description uses broad activation phrases like 'social features' and 'cross-bot interaction,' which can cause the skill to trigger in unrelated conversations. Over-broad routing is dangerous because it may inject instructions for linking external messaging platforms and modifying bot behavior in contexts where the user did not explicitly request that action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to disable Telegram bot privacy mode but does not clearly warn that this allows the bot to read all visible channel messages, potentially including content users did not expect the bot to ingest. That omission creates a consent and privacy risk, especially because the setup is for shared multi-party channels where other participants may not understand the increased message visibility.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. Open your OpenClaw configuration panel.
3. Find the section for Telegram channel binding (often under "Channels" or "Connections").
4. Paste the Chat ID and save.
5. OpenClaw should automatically send a test message to the channel to confirm the connection works.

If the test message appears in the Telegram channel, the connection is live.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.