ClawHub
Back to skill

Security audit

Telegram Media

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear media-sending purpose, but it gives broad instructions to upload local files and execute shell snippets without enough safeguards.

Review before installing. Only use this in an environment where the Telegram recipient, bot token, and ElevenLabs key are intentionally configured, and do not let it send arbitrary local files or sensitive text. Safer versions should remove the hard-coded recipient fallback, restrict uploads to generated output directories, require confirmation before external sends, and replace inline shell templates with a validated script or structured arguments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:113
Finding

Unsafe Template Substitution Enables Shell and Python Code Injection

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:38
Finding

Unrestricted Local File Upload with a Hard-Coded Telegram Recipient

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:123
Finding

Predictable Shared Temporary File Permits Symlink and File-Replacement Attacks

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:3
Finding

Unconditional Command-Execution Instructions Weaken Agent Safety Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

o send media (not just text) via Telegram

Environment

All commands run from ~/clawd where load_env.py loads the .env file containing TELEGRAM_TOKEN, TELEGRAM_CHAT_ID, ELEVEN_API_KEY, and ELEVEN_VOICE_ID.

Boss Man's chat ID: 7887978276

Send a Photo/Chart via Telegram

bash
cd ~/clawd && python3 -c "
import os, sys, requests
sys.path.insert(0, '.')
import load_env
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('PHOTO_PATH', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
        data={'chat_id': CHAT, 'caption': 'CAPTION_HERE'},
        files={'photo': f}, timeout=30)
print(r.json())
"

Replace PHOTO_PATH with the actual file path and CAPTION_HERE with your caption.

Send a Document/File via Telegram

bash
cd ~/clawd && python3 -c "
import os, sys, requests
sys.path.insert(0, '.')
import load_env
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_I

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is explicitly designed to send user-provided content, generated charts, files, and TTS text to third-party services (Telegram and ElevenLabs), but its description does not clearly warn the user about those outbound disclosures. This creates a meaningful consent and data-handling risk because operators may invoke the skill without realizing prompts, files, or generated artifacts will leave the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This command uploads a local photo or chart to Telegram using a bot token, sending file contents and caption text to an external messaging platform. If the referenced file is sensitive or attacker-influenced, the skill enables straightforward exfiltration outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('PHOTO_PATH', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
        data={'chat_id': CHAT, 'caption': 'CAPTION_HERE'},
        files={'photo': f}, timeout=30)
print(r.json())

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This document upload command can send arbitrary local files to Telegram, not just generated artifacts. In skill context, that makes it more dangerous than a simple network call because it can be used to exfiltrate secrets, configuration files, credentials, or other sensitive documents from the host.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('FILE_PATH', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendDocument',
        data={'chat_id': CHAT, 'caption': 'CAPTION_HERE'},
        files={'document': f}, timeout=30)
print(r.json())

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This sends a generated chart image to Telegram, which is an external disclosure of locally generated content. While lower risk than arbitrary file upload, the skill still transmits data off-system and should not do so without clear disclosure and user intent.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('charts/chart_btc.png', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
        data={'chat_id': CHAT, 'caption': 'BTC — Daily TA Chart'},
        files={'photo': f}, timeout=30)
print(r.json())

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The bulk-send workflow iterates over all chart files and uploads them to Telegram, increasing the amount of data disclosed in a single command. Because it automates repeated external transmission, mistakes or stale/unintended files in the charts directory could be sent without granular review.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
for chart in sorted(glob.glob('charts/chart_*.png')):
    name = os.path.basename(chart).replace('chart_', '').replace('.png', '').upper()
    with open(chart, 'rb') as f:
        r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendPhoto',
            data={'chat_id': CHAT, 'caption': f'{name} — Daily TA Chart'},
            files={'photo': f}, timeout=30)
    print(f'Sent {name}: {r.status_code}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code sends arbitrary text content to ElevenLabs for speech generation, which is an external transmission to a third party. If the text contains sensitive user data, internal analysis, credentials, or regulated information, the skill will disclose it outside the trusted boundary.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
API_KEY = os.getenv('ELEVEN_API_KEY') or os.getenv('ELEVENLABS_API_KEY')
VOICE_ID = os.getenv('ELEVEN_VOICE_ID', '1SM7GgM6IMuvQlz2BwM3')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This is the concrete ElevenLabs API endpoint used to send text externally for TTS processing. In context, the risk is not the endpoint itself but the unguarded transfer of potentially sensitive text to a third party without clear notice or filtering.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
VOICE_ID = os.getenv('ELEVEN_VOICE_ID', '1SM7GgM6IMuvQlz2BwM3')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
          'voice_settings': {'stability': 0.5, 'similarity_boost': 0.75}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This uploads the generated MP3 voice note to Telegram, exposing the spoken content to an external service. If the audio contains sensitive analysis or user data, the disclosure risk mirrors sending the raw text, with the added difficulty of auditing audio content after the fact.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
with open('/tmp/frank_voice.mp3', 'rb') as f:
    r = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendVoice',
        data={'chat_id': CHAT, 'caption': 'Voice note from Frank'},
        files={'voice': f}, timeout=30)
print(r.json())

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The one-shot TTS workflow transmits user-supplied text to ElevenLabs before sending the resulting audio onward. This compounds disclosure risk because sensitive content may be exposed to multiple third-party services in a single action without separate confirmation.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
TOKEN = os.getenv('TELEGRAM_TOKEN')
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This is another explicit ElevenLabs transmission point in the combined TTS-and-send workflow. It is dangerous because sensitive text is exported to ElevenLabs automatically as part of a chained action, reducing opportunities for operator review.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
CHAT = os.getenv('TELEGRAM_CHAT_ID', '7887978276')
text = '''TEXT_TO_SPEAK'''
r = requests.post(
    f'https://api.xi-labs.com/v1/text-to-speech/{VOICE_ID}',
    headers={'xi-api-key': API_KEY, 'Content-Type': 'application/json'},
    json={'text': text, 'model_id': 'eleven_multilingual_v2',
          'voice_settings': {'stability': 0.5, 'similarity_boost': 0.75}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This sends the generated voice file to Telegram in the one-shot workflow, creating another external disclosure step. In combination with prior TTS generation, the skill can relay sensitive content through two external providers with minimal friction.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
f.write(r.content)
    import time; time.sleep(0.5)
    with open('/tmp/frank_voice.mp3', 'rb') as f:
        r2 = requests.post(f'https://api.telegram.org/bot{TOKEN}/sendVoice',
            data={'chat_id': CHAT},
            files={'voice': f}, timeout=30)
    print(f'Voice sent: {r2.status_code}')

Static analysis

No suspicious patterns detected.