ClawHub
Back to skill

Security audit

pikpak-telegram-bot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Telegram remote control for PikPak with explicit authorization, whitelist, state, and recovery safeguards; its powerful actions are expected for its purpose.

Use this only with a bot token and PikPak CLI account you intend to automate. Keep the state directory private, set narrow chat/user whitelists, avoid custom TG_API_BASE unless it is your trusted HTTPS endpoint, and be aware the disclosed referral code may reward the publisher if you choose to use it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill describes and encourages use of capabilities including environment-variable secrets, filesystem state, network access to Telegram, and shell execution of a PikPak CLI, but it does not declare any explicit tool/permission scope. In a security-sensitive automation skill, that omission weakens review and enforcement boundaries, making it easier for an agent or operator to invoke powerful actions without clear guardrails or least-privilege constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation condition includes broad natural-language triggers like mentions of Telegram remote-control for PikPak or sending magnets via Telegram, without tighter exclusions or a requirement that the user is specifically asking to deploy or operate this exact skill. That can cause over-activation in adjacent contexts, increasing the chance an agent applies a networked, stateful, shell-capable skill where a safer informational response or different workflow would be more appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

SQP-3 applies to all file types and covers language/locale policy violations. This markdown file presents all operational and safety guidance only in Chinese, and the text does not indicate user opt-in, bilingual availability, or a region-specific justification for restricting the skill documentation to that language.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/upstream-design.md (reported line 17)May include surrounding context.

md
## 许可证与正式发行边界

- 固定提交 [`pyproject.toml:12-13`](https://github.com/python-telegram-bot/python-telegram-bot/blob/577e9c784607a42ff17746b9864b6416c3c30593/pyproject.toml#L12-L13) 声明 **LGPL-3.0-only**，license-files 为 LICENSE / LICENSE.dual / LICENSE.lesser。已只读核验 [`LICENSE.lesser`](https://github.com/python-telegram-bot/python-telegram-bot/blob/577e9c784607a42ff17746b9864b6416c3c30593/LICENSE.lesser)（LGPL v3）及 [`LICENSE`](https://github.com/python-telegram-bot/python-telegram-bot/blob/577e9c784607a42ff17746b9864b6416c3c30593/LICENSE)（被 LGPL 纳入的 GPL v3 正文）；不能仅因 LICENSE 的 GPL 标题把整个项目误判为 GPL-only。LICENSE.dual 的具体适用条款未在此独立核验，不猜测例外授权。
- 已只读核对公开正式发行元数据：[v22.8](https://github.com/python-telegram-bot/python-telegram-bot/releases/tag/v22.8)，[GitHub releases API](https://api.github.com/repos/python-telegram-bot/python-telegram-bot/releases/latest)。这不是研读 snapshot 与 tag 的祖先关系证明：**祖先关系、发行制品及运行兼容性未核验**，不把 snapshot 当作该 release。
- 本项目只借鉴授权/调度/去重机制，未安装或运行 PTB；若将来复制或分发上游代码，须另核完整许可证及文件级条件。Celery 的代码 BSD-3-Clause / 文档 CC BY-SA 4.0 证据见 guardian 的对应 references，不将“开源”视为无条件复制授权。

## 采纳 / 不采纳 / 实际落地

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tg_bot.py (reported line 571)May include surrounding context.

python
"""调用 pikpak CLI；返回 (rc, stdout, stderr)。"""
    bin_path = os.environ.get("PIKPAK_BIN", "pikpak")
    try:
        proc = subprocess.run([bin_path, *args], capture_output=True, text=True, timeout=timeout)
        return proc.returncode, proc.stdout, proc.stderr
    except FileNotFoundError:
        return 127, "", "找不到 pikpak 命令，请先安装 PikPak CLI"

Tainted flow: 'bin_path' from os.environ.get (line 569, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/tg_bot.py (reported line 571)May include surrounding context.

python
"""调用 pikpak CLI；返回 (rc, stdout, stderr)。"""
    bin_path = os.environ.get("PIKPAK_BIN", "pikpak")
    try:
        proc = subprocess.run([bin_path, *args], capture_output=True, text=True, timeout=timeout)
        return proc.returncode, proc.stdout, proc.stderr
    except FileNotFoundError:
        return 127, "", "找不到 pikpak 命令，请先安装 PikPak CLI"

Static analysis

No suspicious patterns detected.