ClawHub
Back to skill

Security audit

Session Context Injector

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is purpose-aligned: it sends disclosed Telegram context-refresh messages from project status files, but users should verify recipients and avoid sending sensitive status details to the wrong chat.

Before installing, confirm this is for your Telegram workspace, use a least-privileged bot token, verify each chat_id especially the named direct-message path, and keep secrets out of STATUS.md because resume points and blockers may be posted to Telegram and recorded in local logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly reads project STATUS.md content and sends derived context to Telegram via the Bot API, but the description does not clearly warn users that potentially sensitive project state will be transmitted to an external service. This can cause unintended disclosure of internal project details, blockers, or operational context to chats or recipients the user did not fully understand were involved.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill persists records of injections to memory files and appends a note to STATUS.md, but it does not clearly inform users that running the skill creates or modifies local persistent records. Unexpected persistence can expose operational metadata, leak chat identifiers, or create audit trails users did not intend to retain.

Static analysis

No suspicious patterns detected.