ClawHub
Back to skill

Security audit

Telegram News Digest (Lite)

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its Telegram digest purpose, but it needs review because it sends message text and a gateway token to configurable LLM endpoints while its privacy documentation is inconsistent.

Review the configured LLM gateway before installing. Use only trusted HTTPS or loopback endpoints, restrict and rotate OPENCLAW_GATEWAY_TOKEN, assume monitored Telegram message text can leave the host for summarization, and avoid monitoring sensitive channels unless that external processing is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
src/index.js:38
Finding

Gateway Credential Disclosure Through an Unvalidated Gateway URL

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/summarizer.js:65
Finding

Indirect Prompt Injection Through Untrusted Telegram Messages

Content
View full analysis
`• ${m.text}`) .join("\n"); return `You are a professional news analyst. Review these Telegram messages and return ONLY valid JSON: { "summary": "Concise summary in ${config.language} (max ${config.max_tokens_per_channel} tokens). Focus on factual updates, ignore spam/repeats/ads.", "tags": ["topic1", "topic2"], "sentiment": "positive|neutral|negative" } Messages from channel: ${messageList} Rules: - Output MUST be valid JSON, no markdown, no explanations - Summary should be 2-4 bullet points worth of information - Tags should be 2-4 relevant keywords - If no meaningful content, set summary to "No significant updates.`; } ``` ```js // src/index.js:226-244 for (const item of sorted) { body += `🔹 **@${item.channel}** (${item.count} new message${item.count > 1 ? 's' : ''})\n`; body += `${item.summary}\n`; if (item.tags?.length) body += `🏷 ${item.tags.join(", ")}\n`; body += `\n`; } const footer = cfg.format === "markdown" ? `\n*Generated by tg-news-digest-lite • [Report issues](https://github.com/your-org/tg-news-digest-lite)*` : ""; return header + body + footer; ``` ```js // src/index.js:240-244 async _notify(text, channel, ctx) { // Preferred: use OpenClaw's session.send for integrated delivery if (typeof ctx?.send === "function") { await ctx.send({ channel, content: text }); logger.info(`Digest sent to channel: ${channel}`); ``` ### Technical Analysis Telegram channel messages are attacker-controlled input. The Skill concatenates this content directly into the same user prompt that contains the summarization rules. There is no strong trust-boundary separation, no explicit h ...[truncated 2564 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.

openclaw logs --grep "tg-news" --tail 50

text

### Reset State (Start Fresh)
```bash
# Backup then delete state
mv ~/.openclaw/skills/tg-news-digest-lite/state/seen_messages.json \

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it extracts Telegram messages, generates AI summaries, and uses external AI endpoints, but it does not warn users that channel content may be transmitted to third-party providers such as OpenAI, OpenRouter, or DeepInfra. This omission is dangerous because users may reasonably assume scraping public channels is local processing, while the actual design can export message content to external processors with separate retention and privacy practices.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

md
async clearChannel(channel) {
    const state = await this.init();
    if (state.channels?.[channel]) {
      delete state.channels[channel];
      await fs.outputJson(this.path, state, { spaces: 2 });
    }
  }

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · src/storage.js (reported line 63)May include surrounding context.

js
async clearChannel(channel) {
    const state = await this.init();
    if (state.channels?.[channel]) {
      delete state.channels[channel];
      await fs.outputJson(this.path, state, { spaces: 2 });
    }
  }

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation is internally inconsistent: it claims the skill does not forward raw messages to third parties, yet elsewhere states that message text is sent to an external LLM provider. This can mislead operators about privacy boundaries and cause unintended disclosure of scraped Telegram content to external services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.

md
openclaw config get agents.defaults.model.primary

# Test LLM connectivity manually
curl -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen/qwen3.5-35b","messages":[{"role":"user","content":"test"}]}' \
  https://your-gateway/v1/chat/completions

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes filesystem access to ./state and ./config.yaml and includes tools that modify tracked channels, but the description does not warn that these changes persist across runs. This is risky because users may treat tool actions as ephemeral, when they can actually alter future monitoring, cached message state, and downstream notifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The run_digest_cycle tool description is broad and action-oriented, which can increase the chance that an agent invokes it when a user only asks for information about monitoring or summaries. Because the tool performs network fetching, AI summarization, and delivery to a configured channel, unintended activation could trigger external data transmission and side effects without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The configure_channels description allows adding or removing monitored channels without stating authorization or scope constraints, which raises the risk of accidental or overly broad persistent reconfiguration. In context, this changes future monitoring behavior and can silently expand what content is scraped and later transmitted to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code sends raw Telegram message contents to an external LLM endpoint for summarization, which creates a real data exposure risk if messages contain sensitive, private, or regulated information. Even if this is intended functionality, there is no evidence here of user consent, redaction, minimization, or disclosure, so channel content may be transmitted off-platform without adequate safeguards.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency uses a caret range, which allows newer semver-compatible releases to be installed over time instead of a single vetted version. This creates supply-chain uncertainty and can accidentally introduce vulnerable or breaking transitive code, especially for a network-facing scraping agent that depends on HTTP functionality.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"author": "your-name <your-email@example.com>",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.8",
    "cheerio": "^1.0.0-rc.12",
    "fs-extra": "^11.2.0",
    "openai": "^4.28.0",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Axios is both unpinned and associated with multiple known advisories, so the manifest does not provide enough assurance that installs will avoid affected versions. Given this skill performs web scraping over the network, any SSRF, proxy-bypass, or request-manipulation flaw in the HTTP client is more relevant than it would be in an offline-only tool.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Using an unpinned fs-extra version permits automatic uptake of later compatible releases that have not been explicitly reviewed. While this is not an immediate exploit by itself, it increases supply-chain risk and reduces build reproducibility.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"dependencies": {
    "axios": "^1.6.8",
    "cheerio": "^1.0.0-rc.12",
    "fs-extra": "^11.2.0",
    "openai": "^4.28.0",
    "yaml": "^2.4.1"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The openai package is unpinned, so future installs may resolve to a different library release than the one originally tested. In an autonomous agent context, SDK changes can affect request handling, authentication flows, or data exposure behavior, making dependency drift more consequential than in a static utility.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"axios": "^1.6.8",
    "cheerio": "^1.0.0-rc.12",
    "fs-extra": "^11.2.0",
    "openai": "^4.28.0",
    "yaml": "^2.4.1"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The yaml dependency is not pinned, and this package family has had denial-of-service style parsing issues in the past. Allowing version drift in a parser library is risky because even semver-compatible updates may expose the agent to unstable or vulnerable parsing behavior when handling untrusted content or configuration.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"cheerio": "^1.0.0-rc.12",
    "fs-extra": "^11.2.0",
    "openai": "^4.28.0",
    "yaml": "^2.4.1"
  },
  "engines": {
    "node": ">=20.0.0"

Unverifiable Dependency: yaml has 2 known advisory(ies) (CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections); CVE-2023-2251 (Uncaught Exception in yaml)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The yaml package has known advisories and the manifest leaves the exact installed version undefined, so vulnerable releases cannot be ruled out. If the skill parses YAML from configuration or other external sources, parser crashes or resource exhaustion could be triggered by maliciously crafted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The digest header uses toLocaleString('en-US', ...) directly, which forces a specific locale in user-facing output. The policy requires offering language/locale choice or clearly documenting a justified regional constraint, neither of which is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code path for cfg.group_by === "time" is commented as a placeholder for time sorting, yet it actually sorts items by channel.localeCompare, which is not time-based grouping. This is an active contradiction between inline documentation and behavior, even though the impact is limited to output formatting rather than a security-sensitive action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The natural-language instruction mandates summary in ${config.language}, which can enforce a specific language/locale in generated output. In this file there is no indication that the user is offered a language choice or has opted into that locale behavior, which may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.