Security audit

Telegram Agent Setup V101

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Telegram setup guide with disclosed, purpose-aligned risks around group message visibility and optional voice transcription dependencies.

Install only if you intend to connect OpenClaw to Telegram. Keep allowedChatIds and rejectUnknown enabled, treat the bot token as a secret, avoid adding the bot to groups unless participants understand it may see group messages, and prefer pinned or reviewed dependency versions if enabling faster-whisper voice transcription.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:139
Finding: Unpinned Third-Party Speech-to-Text Dependency
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 139-144
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
python3 -m venv ~/.openclaw/venvs/stt-tools source ~/.openclaw/venvs/stt-tools/bin/activate pip install faster-whisper

Technical Analysis

The installation instructions retrieve and install the latest version of faster-whisper and its transitive dependencies without version constraints or integrity hashes. Consequently, the effective code installed on a user's system can change after this Skill has been reviewed.

Python package installation may execute package build or installation logic. The package is also subsequently imported by the supplied transcription example, providing another opportunity for compromised dependency code to execute. This is a supply-chain weakness; the audit found no evidence that faster-whisper itself is currently malicious.

Attack Path

An attacker compromises the named package, one of its transitive dependencies, or an associated publishing account.

The attacker publishes a malicious release that remains compatible with the unrestricted package specification.

A user follows the Skill and runs pip install faster-whisper.

pip resolves and downloads the attacker-controlled release or dependency.

Malicious code executes during package installation or when the transcription script imports and uses the package.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or the transcription process. It could access files available to that account, including OpenClaw configuration and locally stored credentials, alter user-owned files, execute additional processes, or communicate with external systems. The scope would normally be limited to the installing user's permissions unless installation is performed under an elevated ac ...[truncated 6 chars]
Remediation: View remediation
Remediation Suggestions

Pin faster-whisper and every transitive dependency to reviewed versions in a lock file.

Record and verify cryptographic hashes using a requirements file and pip install --require-hashes -r requirements.txt.

Generate the lock file from a trusted package index and review dependency changes before updating it.

Install dependencies in the documented isolated virtual environment under a non-privileged account.

Avoid sudo pip and other elevated installation methods.

Consider scanning locked packages and their artifacts with software-composition and malware-analysis tools before distribution.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:45
Finding: Group Privacy Is Disabled Beyond the Recommended Response Scope
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 45-48
Vulnerability Type: Excessive Telegram bot access to group messages
Risk Level: Medium

Vulnerable Configuration Instructions:

text
/setprivacy → Disable (so bot sees all messages in groups) /setjoingroups → Enable (if you want to add bot to groups) /setcommands → Set your commands: start - Start the bot

Technical Analysis

Disabling Telegram BotFather privacy mode allows the bot to receive supported group messages beyond commands and direct mentions. The Skill later recommends configuring group responses to occur only when the bot is mentioned, but response filtering does not necessarily prevent the Telegram integration from receiving or processing unrelated messages.

This configuration exceeds least privilege for deployments that only require command-based or mention-based interaction. Although the guide recommends allowedChatIds and rejectUnknown, those controls restrict which chats are accepted; they do not minimize message visibility within an authorized group.

Attack Path

An administrator follows the guide and disables the bot's group privacy mode.

The administrator adds the bot to an authorized Telegram group and places that group in allowedChatIds.

Group participants send ordinary messages that are neither commands nor direct mentions.

Telegram delivers those messages to the bot because privacy mode is disabled.

The Telegram integration, OpenClaw, or a configured model provider may receive content that participants did not intend as bot input.

Impact Assessment

The bot can gain visibility into conversations throughout every authorized group in which privacy mode is disabled. The exposed scope may include personal information, confidential discussions, links, attachments, or operational data posted by group members. This does not directly grant operating-system privileges, but it broaden ...[truncated 137 chars]
Remediation: View remediation
Remediation Suggestions

Keep BotFather privacy mode enabled by default for command-based and mention-based workflows.

Present privacy-mode disabling as an optional configuration only when receiving every group message is an explicit functional requirement.

Explain clearly that disabling privacy mode exposes non-command and non-mention group traffic to the bot.

Obtain informed consent from group administrators and participants before enabling broad message visibility.

Continue enforcing strict allowedChatIds, rejectUnknown: true, and mention-only response behavior as defense-in-depth controls.

Apply data-minimization, logging, retention, and external-provider policies to group content.

Use a dedicated bot with narrowly scoped group membership when full-message access is unavoidable.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
- Telegram account - Access to @BotFather on Telegram ## Step 1: Create a Telegram Bot 1. Open Telegram, find **@BotFather** 2. Send `/newbot`

Natural-Language Policy Violations