T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:52- Finding
Telegram Authentication QR Credential Exposed Through Logs and Predictable Temporary Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram QR Login Workaround
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly documents a Telegram QR login workaround, but it also asks users to share access tokens and handles login QR codes in ways that could expose accounts.
Install only if you are comfortable auditing and correcting the workflow first. Do not send GitHub PATs, ClawHub tokens, Telegram QR login URLs, or QR images to an assistant or chat. If using the Telegram portion, generate and display the QR locally, store session files privately, delete temporary QR artifacts, and avoid the unrelated publishing instructions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:90- Finding
Authentication QR Is Transmitted Through a Messaging Channel Without Recipient Validation
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:122- Finding
Unnecessary GitHub Personal Access Token Collection and Exposure
- Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{ "description": "", "public": true, "files": { "telegram-qr-login.md": {"content": "..."} } }' ``` ### Technical Analysis The Skill's declared purpose is Telegram QR login, but it additionally directs the user to create and disclose a GitHub personal access token. This credential is not required to perform Telegram authentication. Asking the user to send the PAT to an agent exposes it to conversation history and associated logging or monitoring systems. Substituting the token directly into a command can additionally expose it through shell history, command auditing, debugging output, or process inspection. Although the requested `gist` scope is narrower than a general repository token, it still grants authenticated access to the user's Gists. ### Attack Path 1. A user follows the unrelated publication instructions and creates a GitHub PAT. 2. The user sends the token to the agent or inserts it directly into the documented command. 3. The token is retained in conversation logs, shell history, execution records, or process metadata. 4. An attacker or unauthorized operator obtains access to one of those records. 5. The attacker uses the PAT against the GitHub API. 6. The attacker reads, creates, modifies, or deletes resources allowed by the token's effective scopes until it expires or is revoked. ### Impact Assessment Compromise grants the attacker the GitHub permissions assigned to the PAT. With the ...[truncated 245 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:35- Finding
Unpinned Python Dependencies Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:140- Finding
Unpinned Global ClawHub Installation and Command-Line Token Exposure
- Content
View full analysis
` or use the interactive browser method ``` ### Technical Analysis The Skill recommends globally installing an unpinned npm package unrelated to its Telegram-login purpose. Global npm installation increases system-wide impact and can execute package lifecycle scripts during installation. No version, lock file, integrity hash, or provenance control is provided. The alternate login command passes a token as a command-line argument. On affected environments, arguments can be exposed through shell history, audit logs, process listings, debugging output, or agent execution transcripts. ### Attack Path 1. A user follows the global installation instruction. 2. npm resolves the current package release and dependency tree. 3. A compromised package, dependency, maintainer account, or lifecycle script executes during installation with the invoking user's privileges. 4. Alternatively, the user places the ClawHub token directly in the documented command. 5. An attacker obtains the token from process metadata, shell history, logs, or transcripts. 6. The attacker authenticates to ClawHub with the victim's token and performs actions permitted by that account. ### Impact Assessment A dependency compromise can execute arbitrary code with the permissions of the npm installation process; if global installation is performed with elevated privileges, system-wide files may be affected. Token disclosure can allow unauthorized access to the victim's ClawHub accoun ...[truncated 35 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill tells users to create a GitHub personal access token and send it to the operator, which is a direct credential-sharing anti-pattern. An operator with that token can act on the user's GitHub account within the granted scope, and users are not warned about the sensitivity, alternatives, or least-privilege handling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The instructions explicitly direct the user to obtain and hand over a GitHub PAT for the assistant/operator to use. This is dangerous because it normalizes transfer of reusable authentication secrets to a third party, enabling unauthorized repository/gist actions and possible downstream account compromise within token scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description, headings, instructions, and examples are presented entirely in Chinese, but the skill does not state that it is intended only for Chinese-speaking users or offer an alternative language. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill significantly expands beyond Telegram QR-login troubleshooting into dialogue cleanup and publishing workflows, increasing the operational scope and the chance users are steered into unrelated sensitive actions. Scope creep is dangerous here because the added sections introduce credential handling and external publication steps that are not necessary for solving the stated Telegram login problem.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The publication guidance introduces token use, external API calls, and third-party platform authentication that are unrelated to the declared purpose of resolving PHONE_CODE_EXPIRED. This broadens the attack surface and can lead users to disclose credentials or transmit content externally without necessity, making the skill materially more dangerous than its stated function suggests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The skill instructs external transmission to GitHub's API in conjunction with a user-provided token, which creates a data egress path not required for Telegram QR-login troubleshooting. In context this is risky because it couples outbound transmission with credential use and encourages publishing content to a third-party service for unrelated reasons.
- Content
GitHub Gist（最快，1分钟搞定）
用户去 https://github.com/settings/tokens/new 创建 PAT（勾
gistscope），发给你后用 curl 直接调用 GitHub API：bash curl -s -X POST "https://api.github.com/gists" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Referencing the GitHub API endpoint itself is not inherently dangerous, but in this context it is part of an unnecessary external publication flow that uses user credentials. The danger comes from combining third-party transmission with PAT-based authorization in a skill whose stated purpose is unrelated to GitHub publishing.
- Content
用户去 https://github.com/settings/tokens/new 创建 PAT（勾
gistscope），发给你后用 curl 直接调用 GitHub API：bash curl -s -X POST "https://api.github.com/gists" \ -H "Authorization: token <PAT>" \ -H "Content-Type: application/json" \ -d '{
Static analysis
No suspicious patterns detected.