ClawHub
Back to skill

Security audit

Telegram Media

Security checks across malware telemetry and agentic risk

Overview

This skill matches its Telegram media purpose, but it can send local files or generated voice content through your credentials to a hardcoded Telegram chat unless carefully reconfigured.

Review before installing. Set TELEGRAM_CHAT_ID to your own destination, remove the hardcoded fallback, inspect the ~/clawd helper scripts, and require explicit confirmation of every recipient, file path, and text payload. Do not use it to send secrets, credentials, internal documents, or sensitive user content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to transmit files, generated charts, and synthesized voice content to third-party services (Telegram and ElevenLabs) without any user-facing consent, warning, or data-classification guardrails. In an agent setting, this creates a real risk of unintended disclosure of sensitive local files, analysis output, or user-provided text to external providers.

External Transmission

Medium
Category
Data Exfiltration
Content
API_KEY = os.getenv('ELEVEN_API_KEY') or os.getenv('ELEVENLABS_API_KEY')
VOICE_ID = os.getenv('ELEVEN_VOICE_ID', '1SM7GgM6IMuvQlz2BwM3')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
Confidence
94% confidence
Finding
This code sends arbitrary text in TEXT_TO_SPEAK to ElevenLabs, which is an external third party. If the agent is induced to include sensitive prompts, personal data, or confidential analysis in that text, the skill will exfiltrate it off-system without review or minimization.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
Confidence
95% confidence
Finding
This one-shot flow combines third-party TTS generation with later Telegram delivery, increasing the chance that sensitive user content is automatically sent to multiple external services in one action. Because the text is arbitrary and directly embedded, prompt-derived or confidential content could be disclosed without an intermediate review step.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('PHOTO_PATH', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
        data={'chat_id': CHAT, 'caption': 'CAPTION_HERE'},
        files={'photo': f}, timeout=30)
print(r.json())
Confidence
96% confidence
Finding
The skill uploads an arbitrary local file path to Telegram, which can expose any readable file on the host if an attacker or mis-specified prompt controls PHOTO_PATH. In an agent environment, that makes local file exfiltration materially possible through a normal-looking media-send workflow.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('FILE_PATH', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendDocument',
        data={'chat_id': CHAT, 'caption': 'CAPTION_HERE'},
        files={'document': f}, timeout=30)
print(r.json())
Confidence
98% confidence
Finding
This document upload path is more dangerous because FILE_PATH can refer to any file, not just media, enabling exfiltration of credentials, source code, internal reports, or environment files to Telegram. The presence of loaded secrets in the working environment increases the risk that nearby sensitive files could be transmitted by mistake or abuse.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('charts/chart_btc.png', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
        data={'chat_id': CHAT, 'caption': 'BTC — Daily TA Chart'},
        files={'photo': f}, timeout=30)
print(r.json())
Confidence
90% confidence
Finding
Even though this targets a chart file, it still performs external transmission to Telegram without verifying the file contents or whether the chart may embed sensitive or proprietary information. The workflow normalizes automatic outbound delivery, which is risky in an agent that may generate or select files based on untrusted instructions.

External Transmission

Medium
Category
Data Exfiltration
Content
for chart in sorted(glob.glob('charts/chart_*.png')):
    name = os.path.basename(chart).replace('chart_', '').replace('.png', '').upper()
    with open(chart, 'rb') as f:
        r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
            data={'chat_id': CHAT, 'caption': f'{name} — Daily TA Chart'},
            files={'photo': f}, timeout=30)
    print(f'Sent {name}: {r.status_code}')
Confidence
92% confidence
Finding
This loop bulk-sends every matching chart file in the directory, which increases blast radius if the directory contains unintended files or if chart generation included sensitive information. Bulk automated exfiltration is more dangerous than a single reviewed send because multiple files can leave the system in one command.

External Transmission

Medium
Category
Data Exfiltration
Content
VOICE_ID = os.getenv('ELEVEN_VOICE_ID', '1SM7GgM6IMuvQlz2BwM3')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
          'voice_settings': {'stability': 0.5, 'similarity_boost': 0.75}},
Confidence
94% confidence
Finding
This is the concrete ElevenLabs endpoint usage that transfers arbitrary text off-platform for speech synthesis. In context, the skill encourages real execution of commands and lacks any privacy or sensitivity checks, making accidental disclosure more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('/tmp/frank_voice.mp3', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendVoice',
        data={'chat_id': CHAT, 'caption': 'Voice note from Frank'},
        files={'voice': f}, timeout=30)
print(r.json())
Confidence
93% confidence
Finding
This sends the generated audio file to Telegram, which is another external transfer of potentially sensitive synthesized content. Voice notes can encode confidential analysis or user data, and once transmitted they may be retained outside the local security boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
          'voice_settings': {'stability': 0.5, 'similarity_boost': 0.75}},
Confidence
95% confidence
Finding
This endpoint call is part of the one-shot chain that sends arbitrary text to ElevenLabs before forwarding the resulting audio elsewhere. The chained design reduces opportunities for human review and therefore increases the likelihood of unintended third-party disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
f.write(r.content)
    import time; time.sleep(0.5)
    with open('/tmp/frank_voice.mp3', 'rb') as f:
        r2 = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendVoice',
            data={'chat_id': CHAT},
            files={'voice': f}, timeout=30)
    print(f'Voice sent: {r2.status_code}')
Confidence
94% confidence
Finding
This Telegram send completes the one-shot exfiltration path by transmitting generated audio externally without an approval checkpoint. In context, the hardcoded chat ID fallback and insistence on real execution make the outbound action more operationally dangerous, not less.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.