T08 · Insecure Dependencies
Warning
- Location
SETUP.md:7- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Interactive Buttons
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Telegram button helper that sends and edits bot messages, with some setup and example-documentation risks but no evidence of hidden persistence, destructive actions, or credential theft.
Use this only with a Telegram bot and chats you control. Prefer a pinned or otherwise trusted OpenClaw CLI install, keep the bot token out of shell history and logs, use environment variables or secure config, and treat the backup/delete example as a simulated message flow rather than proof that any file operation happened.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SETUP.md:56- Finding
Telegram Bot Token Exposed Through a Command-Line URL
- Content
View full analysis
/getUpdates" ``` Look for `"chat":{"id":123456789}` in the response. ``` ### Technical Analysis The documented command requires the user to substitute the Telegram bot token directly into a URL passed as a command-line argument. Although HTTPS protects the request while it is transmitted to Telegram, it does not protect the token from local exposure. The resulting command may be retained in shell history. While the command is running, the complete URL may also be visible through process inspection facilities to other processes or users permitted to inspect that process. Diagnostic tooling, terminal logging, command auditing, or copied troubleshooting output may preserve the URL as well. A Telegram bot token is an authentication credential. Possession of it permits Bot API calls as that bot within the scope of the bot's Telegram permissions. ### Attack Path 1. A user replaces `` with a real token and runs the documented command. 2. The shell stores the expanded command containing the token in its history, or a local observer captures the process arguments. 3. An attacker with access to the history file, terminal logs, audit records, or relevant process metadata obtains the token. 4. The attacker submits Telegram Bot API requests using the stolen credential. 5. The attacker impersonates the bot and performs operations allowed by the bot's permissions until the token is revoked. ### Impact Assessment Exploitation allows authentication to the Telegram Bot API as the affected bot. Depending on the bot's permissions and chat membership, an attacker may send messages, retrieve pending updates, interact with users, or disrupt bot workfl ...[truncated 208 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a broader interactive Telegram UI skill centered on creating inline-button messages and handling user interactions. However, the supplied code only performs one narrow action: editing an existing Telegram message's text using
openclaw message edit. While message editing is mentioned in the description, the primary advertised capabilities—creating interactive messages, formatting inline buttons, and handling callbacks—are not implemented in this code chunk. This is a material description-to-behavior mismatch because the actual code supports only a small subset of the declared purpose.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a feature for creating interactive Telegram messages with inline buttons and handling related runtime behaviors such as callback handling and message editing. The supplied code does not implement those capabilities. Instead, it only validates the shape and basic constraints of a JSON button definition passed on the command line. This is related to Telegram button formatting as a supporting utility, but it is materially narrower than the declared primary purpose and omits the core interactive behaviors described. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script sends a success message stating that files were deleted successfully even though no deletion occurs. In an automation context, false destructive-operation confirmations can mislead operators into believing sensitive cleanup happened, causing data exposure, failed incident response, or unsafe follow-on actions based on a false system state.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Method 2 - Via Telegram API:
bash curl "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates"Look for
"chat":{"id":123456789}in the response.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: telegram-interactive-buttons description: Create interactive Telegram messages with inline buttons using OpenClaw CLI. Use when you need user interaction in Telegram (selection from a list, confirmation dialogs, workflow menus, quick actions). Handles button formatting, callback handling, and message editing. Critical for UX-friendly Telegram automation. metadata: { "openclaw":
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Common Patterns
Yes/No Confirmation
bash openclaw message send \
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh #!/bin/bash # Example: Basic Yes/No confirmation dialog # This is the simplest form of interactive buttons # # ⚠️ SECURITY WARNING:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh TARGET="telegram:YOUR_CHAT_ID" # ⚠️ REPLACE WITH YOUR CHAT ID echo "Sending yes/no confirmation..." openclaw message send \ --target "$TARGET" \
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a skill for creating interactive Telegram messages, handling callbacks, and editing messages for UX. This example presents and confirms 'file' operations including deletion and backup, which goes beyond message/button handling and implies operational workflows unrelated to the stated Telegram-interaction scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script claims that a backup was initiated and files are being copied, but it performs no such action. False assurances about backup status can lead users to rely on nonexistent data protection, increasing the risk of data loss if they proceed with risky operations under the assumption that a backup exists.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - `--target` (required): Telegram chat ID - `--message-id` (required): ID of message to edit (returned from original send) - `--message` (required): New message text (buttons automatically removed) ## Button Structure
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a skill for creating interactive Telegram messages, handling button formatting, callbacks, and message editing. At L240, the documentation explicitly recommends using the CLI via
exec, which introduces command-execution capability not justified by that purpose and goes beyond simple message/button operations.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file describes running example scripts that send Telegram messages and labels the full flow as the recommended production pattern, but it does not clearly warn users that executing the examples will transmit content to a real Telegram target. Because this file is the user-facing description for behavior that affects privacy and external systems, a brief disclosure would be appropriate.
- Content
Static analysis
No suspicious patterns detected.