Telegram Wim Wsl File Delivery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed file-delivery helper, but it tells agents to move arbitrary local HTML into OpenClaw's trusted temp directory so it can be sent externally, which needs review before installation.

Install only if you understand that this skill is meant to send local files out through configured chat channels. For HTML reports, require explicit confirmation of the original source path, destination, and provenance, and avoid using it for arbitrary pre-existing HTML or sensitive files unless you have separately verified the file and the temp path handling.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:70

Finding

Arbitrary HTML Is Reclassified Through OpenClaw's Trusted Host-Read Directory

Content

View full analysis

--message \"HTML report\" --media /tmp/openclaw/report.html --force-document --json" } ``` ``` The same pattern is repeated in: - `README.md`, lines 45-56 - `examples/send-html-report.sh`, lines 11-28 - `references/debug-notes.md`, lines 7-20 ### Technical Analysis The skill explicitly documents that OpenClaw rejects HTML from arbitrary workspace locations unless it is located under the trusted generated-HTML temporary root. It then instructs the agent to copy an arbitrary source HTML file into that trusted root and transmit the copy. The only demonstrated checks are `ls` and `file`. These checks may establish that a path exists and identify its apparent MIME type, but they do not establish that: - The file was generated by the current trusted task. - The source file is authorized f ...[truncated 2266 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: examples/send-html-report.sh:13

Finding

Predictable Shared Temporary Paths Permit Symlink Attacks, File Substitution, and Data Disclosure

Content

View full analysis

&2 file "$SRC" >&2 mkdir -p "$TMP" chmod 700 "$TMP" || true cp "$SRC" "$OUT" chmod 600 "$OUT" openclaw message send \ --channel "$CHANNEL" \ --target "$TARGET" \ --message "$MSG" \ --media "$OUT" \ --force-document ``` Predictable fixed paths are also presented in: - `SKILL.md`, line 84 - `README.md`, lines 48-53 - `references/debug-notes.md`, lines 15-20 For example: ```bash mkdir -p /tmp/openclaw chmod 700 /tmp/openclaw || true cp /absolute/path/to/report.html /tmp/openclaw/report.html chmod 600 /tmp/openclaw/report.html openclaw message send --channel telegram --target --message "HTML report" --media /tmp/openclaw/report.html --force-document ``` ### Technical Analysis The script uses the shared, predictable directory `/tmp/openclaw` and derives the destination filename solely from the source basename. It neither creates a unique per-operation directory nor verifies the ownership, type, and permissions of an existing directory. The command `chmod 700 "$TMP" || true` is especially unsafe because it suppresses a failure to secure the directory. If an attacker has already created `/tmp/openclaw` under conditions where the agent cannot change its permissions, execution continues anyway. The destination is also not created with exclusive or no-follow semantics. Standard `cp` behavior can follow a pre-existing destination symlink. An attacker able to control the shared temporary directory can therefore prepare a predictable output name as a symbolic link to another file. Depending on permissions, copying can overwrite that target. There is also a time-of-check/time-of-use interval between copying the file and invoking `openclaw message send`. A local att ...[truncated 2720 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of shell execution via multiple exec commands but does not declare any tool scope such as allowed tools or permissions. This creates unnecessary capability ambiguity: an agent may invoke shell access without an explicit least-privilege contract, increasing the chance of unintended command execution or broader-than-expected filesystem access during file handling and exfiltration workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · examples/send-html-report.sh (reported line 19)May include surrounding context.

sh

ls -lh "$SRC" >&2
file "$SRC" >&2
mkdir -p "$TMP"
chmod 700 "$TMP" || true
cp "$SRC" "$OUT"
chmod 600 "$OUT"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · examples/send-html-report.sh (reported line 21)May include surrounding context.

sh

mkdir -p "$TMP"
chmod 700 "$TMP" || true
cp "$SRC" "$OUT"
chmod 600 "$OUT"

openclaw message send \
  --channel "$CHANNEL" \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

bash

mkdir -p /tmp/openclaw
chmod 700 /tmp/openclaw || true
cp /absolute/path/to/report.html /tmp/openclaw/report.html
chmod 600 /tmp/openclaw/report.html
openclaw message send --channel telegram --target <target> --message "HTML report" --media /tmp/openclaw/report.html --force-document

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

mkdir -p /tmp/openclaw
chmod 700 /tmp/openclaw || true
cp /absolute/path/to/report.html /tmp/openclaw/report.html
chmod 600 /tmp/openclaw/report.html
openclaw message send --channel telegram --target <target> --message "HTML report" --media /tmp/openclaw/report.html --force-document

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/debug-notes.md (reported line 16)May include surrounding context.

bash

mkdir -p /tmp/openclaw
chmod 700 /tmp/openclaw || true
cp /absolute/path/to/report.html /tmp/openclaw/report.html
chmod 600 /tmp/openclaw/report.html
openclaw message send --channel telegram --target <target> --message "HTML report" --media /tmp/openclaw/report.html --force-document

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

mkdir -p /tmp/openclaw chmod 700 /tmp/openclaw || true cp /absolute/path/to/report.html /tmp/openclaw/report.html chmod 600 /tmp/openclaw/report.html openclaw message send --channel telegram --target --message "HTML report" --media /tmp/openclaw/report.html --force-document openclaw message send --channel telegram --target --message "Report archive" --media /absolute/path/to/report.tar.gz --force-document

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

mkdir -p /tmp/openclaw chmod 700 /tmp/openclaw || true cp /absolute/path/to/report.html /tmp/openclaw/report.html chmod 600 /tmp/openclaw/report.html openclaw message send --channel telegram --target --message "HTML report" --media /tmp/openclaw/report.html --force-document openclaw message send --channel telegram --target --message "Report archive" --media /absolute/path/to/report.tar.gz --force-document

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/debug-notes.md (reported line 18)May include surrounding context.

mkdir -p /tmp/openclaw chmod 700 /tmp/openclaw || true cp /absolute/path/to/report.html /tmp/openclaw/report.html chmod 600 /tmp/openclaw/report.html openclaw message send --channel telegram --target --message "HTML report" --media /tmp/openclaw/report.html --force-document openclaw message send --channel telegram --target --message "Report archive" --media /absolute/path/to/report.tar.gz --force-document

text

Static analysis

No suspicious patterns detected.