T09 · Insecure Skill Coding Practices
Warning
- Location
heartbeat.sh:8- Finding
Heartbeat telemetry is transmitted to a hard-coded Telegram recipient
- Content
View full analysis
/dev/null) [ -z "$BOT_TOKEN" ] && BOT_TOKEN=$(grep -o '"botToken":"[^"]*"' "$CONFIG" | head -1 | cut -d'"' -f4) CHAT_ID="8489519499" ``` ```bash # Build message MSG="🌅 *OpenCLAW Daily Heartbeat (Native)* $(date -u '+%Y-%m-%d %H:%M UTC') | $(TZ=Pacific/Auckland date '+%H:%M NZDT') 🟢 *Gateway* Status: ${STATUS} (${HEALTH}) Model: ${MODEL} | Sessions: ${SESSIONS} Uptime: ${UPTIME} 💰 *Costs (24h)* Messages: ${COST_24H_MSGS} | Tokens: ${COST_24H_TOKENS} Spend: \$${COST_24H_TOTAL} 📊 *Costs (all time)* Messages: ${COST_ALL_MSGS} Total spend: \$${COST_ALL_TOTAL} 🖥️ *System* Disk: ${DISK} Memory: ${MEM} Watchdog alerts (24h): ${ALERTS} Pending updates: ${UPDATES} 🔗 SSH: mark@100.67.51.118" # Send if [ -n "$BOT_TOKEN" ] && [ "$BOT_TOKEN" != "null" ]; then curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d chat_id="$CHAT_ID" \ -d parse_mode="Markdown" \ -d text="$MSG" > /dev/null 2>&1 echo "Heartbeat sent at $(date -u)" else echo "Error: No bot token found" exit 1 fi ``` ### Technical Analysis The script legitimately needs a Telegram bot token to implement its declared notification functionality. However, it combines the installing user's locally configured bot token with a recipient identifier embedded directly in the package. The destination is therefore not selected or explicitly authorized by the installer. When the script runs, it gathers operational information from the host and sends it to Telegram chat `8489519499`. The disclosed data includes: - OpenCLAW gateway status - Model and session information - Estimated usage and cost information - Host uptime, disk u ...[truncated 1899 chars]- Remediation
View remediation