Telegram Voice Group

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:19 AM UTC
• Version: 0.1.5

Overview

This skill has a coherent Telegram voice-message purpose, but its current code and setup instructions create avoidable high-impact risks.

Review before installing. Use only with non-sensitive text intended for the target Telegram group, avoid granting the bot admin or moderation powers beyond send messages/media, and do not run the current JavaScript or shell entry points with untrusted input until command construction is hardened.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:42

Finding

OS Command Injection in Text-to-Speech Command Construction

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 42-49
Vulnerability Type: OS command injection through shell interpolation
Risk Level: Critical

Vulnerable Code

javascript

// 1. 清洗文本格式，避免朗读出标记符号
const cleanedText = cleanTextForTTS(text);
console.log(`清洗后的文本: ${cleanedText.substring(0, 50)}...`);

// 2. 使用 edge-tts 生成语音
console.log(`正在生成语音: ${cleanedText.substring(0, 50)}...`);
await execAsync(`edge-tts --voice "${voice}" --rate="${rate}" --text "${cleanedText.replace(/"/g, '')}" --write-media "${tempMp3}"`);

Technical Analysis

The function constructs a shell command by directly interpolating the caller-controlled text, voice, and rate values. child_process.exec executes the resulting string through a system shell.

Removing double-quote characters from cleanedText is not adequate shell escaping. Shell command substitutions such as $(...) and backtick substitutions are evaluated even when they occur inside double quotes. The voice and rate parameters are not sanitized at all and can also contain quote-breaking shell syntax.

Text cleanup is designed for speech formatting and is not a security boundary. It does not prevent shell metacharacters or command substitution.

Attack Path

1. An attacker reaches a workflow that invokes sendVoiceToTelegramGroup.
2. The attacker supplies malicious text, voice, or rate input. For example, the text can contain a shell command substitution expression.
3. The input is interpolated into the command passed to execAsync.
4. The operating-system shell evaluates the injected syntax before or while invoking edge-tts.
5. The injected command executes with the privileges and environment of the OpenClaw/Node.js process.

Impact Assessment

Successful exploitation permits arbitrary operating-system command execution under the service account. Depending on that account's privileges, an attacker could read or modify a ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

• Replace child_process.exec with execFile or spawn and pass each argument as a separate array element.
• Do not invoke a shell for either Edge TTS or FFmpeg.
• Apply an allowlist of supported voice identifiers.
• Validate rate against a narrow expression such as ^[+-](100|[0-9]{1,2})%$, adjusted to the actual supported range.
• Impose text length and character limits appropriate to the TTS service.
• Do not rely on Markdown cleanup as command-injection protection.
• Run media conversion in a restricted service account or sandbox with minimal file and network access.

Example hardened invocation:

javascript

const { execFile } = require('child_process');
const execFileAsync = util.promisify(execFile);

await execFileAsync('edge-tts', [
  '--voice', voice,
  '--rate', rate,
  '--text', cleanedText,
  '--write-media', tempMp3
], {
  shell: false,
  timeout: 120000,
  maxBuffer: 1024 * 1024
});

T09 · Insecure Skill Coding Practices

Error

• Location: send_telegram_voice.js:56

Finding

JavaScript Code Injection Through the Session Key Argument

Content

View full analysis

Vulnerability Details

File Location: send_telegram_voice.js, lines 56-68
Vulnerability Type: JavaScript source injection through shell-generated node -e code
Risk Level: Critical

Vulnerable Code

bash

# 使用 OpenClaw 的 sessions_send 功能发送语音
node -e "
const { sessions_send } = require('@openclaw/core');
sessions_send({
  sessionKey: '$SESSION_KEY',
  message: 'MEDIA:$TEMP_OGG'
}).then(result => {
  console.log('语音消息发送成功');
  console.log(result);
}).catch(err => {
  console.error('发送失败:', err);
});
"

Technical Analysis

The second command-line argument is assigned to SESSION_KEY and then directly inserted into JavaScript source passed to node -e. It is placed inside a single-quoted JavaScript string without JavaScript escaping or structural validation.

A session key containing a single quote can terminate the intended string. Additional JavaScript tokens can then be inserted into the generated program. Because node -e evaluates that generated source as executable JavaScript, a crafted argument can execute arbitrary Node.js code.

Shell quoting around the overall node -e argument does not make the generated JavaScript safe. The vulnerability occurs after shell variable expansion, when Node.js parses the resulting source.

Attack Path

1. An attacker gains the ability to invoke the script or influence its second argument.
2. The attacker supplies a session-key value containing a single quote followed by crafted JavaScript.
3. The shell expands $SESSION_KEY into the node -e source.
4. The injected quote closes the intended sessionKey string and changes the structure of the JavaScript program.
5. Node.js parses and executes the injected code with the script user's privileges.

Impact Assessment

Exploitation provides arbitrary JavaScript execution in Node.js and, through standard Node.js modules, arbitrary operating-system command execution. The attack ...[truncated 386 chars]

Remediation

View remediation

Remediation Suggestions

• Never interpolate data into source code supplied to node -e.
• Pass the session key and media path as ordinary process arguments and read them through process.argv.
• Alternatively, move the Node.js logic into a static .js file and invoke it with data-only arguments.
• Validate the session key against the exact supported grammar before use.
• Reject control characters, quotes, unexpected suffixes, and malformed group or topic identifiers.
• Ensure the Node.js process exits with a nonzero status when message delivery fails.

A safer structure is:

bash

node sender.js "$SESSION_KEY" "$TEMP_OGG"

The static sender.js file can then use:

javascript

const sessionKey = process.argv[2];
const mediaPath = process.argv[3];

No user-controlled value should become executable JavaScript source.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:37

Finding

Predictable Temporary Files in a Shared Directory

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 37-39
Vulnerability Type: Unsafe temporary-file creation and possible symlink race
Risk Level: Medium

Vulnerable Code

javascript

// 生成临时文件名
const tempId = Date.now().toString();
const tempMp3 = `/tmp/voice_${tempId}.mp3`;
const tempOgg = `/tmp/voice_${tempId}.ogg`;

Technical Analysis

Temporary media paths are generated from the current timestamp and placed directly in the system-wide /tmp directory. These names are predictable and are not reserved through atomic, exclusive file creation.

A local attacker who can write to /tmp may predict a filename and create it first, potentially as a symbolic link. Edge TTS and FFmpeg are subsequently instructed to write to these paths, with FFmpeg explicitly using -y to overwrite its output. Cleanup also acts on the same attacker-influenced filesystem entries.

Date.now() can additionally produce collisions when multiple operations begin during the same millisecond.

Attack Path

1. A local attacker observes or predicts when voice generation will occur.
2. The attacker creates /tmp/voice_<timestamp>.mp3 or .ogg before the application does, potentially as a symbolic link to another file.
3. The application invokes Edge TTS or FFmpeg using that predictable path.
4. The external program follows or overwrites the pre-created filesystem entry.
5. A file writable by the service account may be modified, or attacker-supplied media may interfere with message delivery.

Exploitation requires local access to the shared temporary directory and sufficient timing or process-observation capability.

Impact Assessment

The likely scope is the filesystem authority of the OpenClaw service account. Potential consequences include corruption or overwrite of files writable by that account, media substitution, denial of service, and cross-request interference. The impact increases when the ...[truncated 63 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private temporary directory with fs.promises.mkdtemp, using os.tmpdir() as the base.
• Ensure the directory is accessible only by the current service account.
• Generate files within that private directory rather than directly under shared /tmp.
• Use exclusive creation where possible and reject pre-existing output paths.
• Remove the entire private directory recursively during cleanup.
• Limit concurrent jobs and apply process timeouts to prevent abandoned media files.
• Run the service as a non-privileged account.

Example:

javascript

const os = require('os');
const path = require('path');
const fs = require('fs').promises;

const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'telegram-voice-'));
const tempMp3 = path.join(tempDir, 'voice.mp3');
const tempOgg = path.join(tempDir, 'voice.ogg');

// In finally:
await fs.rm(tempDir, { recursive: true, force: true });

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:31

Finding

Deployment Instructions Request Excessive Telegram Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 31-41; duplicated in SKILL.md, lines 39-49
Vulnerability Type: Violation of least privilege
Risk Level: High

Vulnerable Documentation

markdown

### 3. ⚡ 赋予 OpenClaw Bot 群组管理权限
- 在群组信息页面，点击 OpenClaw Bot 的用户名
- 选择 "提升为管理员" 或 "Promote to Admin"
- 授予以下权限：
  - 删除消息 (Delete Messages)
  - 编辑群组信息 (Edit Group Info)
  - 发送消息 (Send Messages)
  - 发送媒体 (Send Media)
  - 限制成员 (Restrict Members)
  - 封禁成员 (Ban Members)
  - 添加管理员 (Add Admins) - 可选，根据需要

Technical Analysis

The documented task is limited to generating audio and sending voice media to a Telegram group or topic. That functionality requires permission to send messages and media, but it does not require authority to delete messages, edit group information, restrict or ban members, or appoint additional administrators.

The installation instructions therefore encourage users to grant privileges beyond the legitimate operational requirements of the skill. This expands the consequences of any compromise of the bot token, OpenClaw runtime, host account, or command-injection vulnerabilities elsewhere in the project.

Attack Path

1. An administrator follows the deployment documentation.
2. The OpenClaw bot is promoted to a Telegram group administrator.
3. The bot receives moderation and group-management permissions unrelated to voice delivery.
4. An attacker compromises the bot token, OpenClaw process, or host, or exploits one of the command-injection vulnerabilities.
5. The attacker uses the bot's excessive privileges to alter group settings, delete content, ban or restrict members, or potentially appoint another administrator.

Impact Assessment

The exposed scope includes every Telegram group configured according to these instructions. Depending on the permissions granted, an attacker could disrupt group operations, remove messages, censor or expel members, alter group ...[truncated 123 chars]

Remediation

View remediation

Remediation Suggestions

• Revise both README.md and SKILL.md to require only the minimum permissions needed to send messages and media.
• Explicitly state that delete-message, edit-group, restrict-member, ban-member, and add-administrator permissions should remain disabled.
• Avoid administrator status entirely if Telegram permits the bot to send voice media as an ordinary member.
• Document a permission-verification checklist for deployment.
• Recommend separate bot identities for unrelated groups to reduce compromise scope.
• Rotate the bot token immediately if compromise is suspected and periodically review group administrator lists.

T08 · Insecure Dependencies

Warning

• Location: DEPENDENCIES.md:5

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: DEPENDENCIES.md, lines 5-10
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Documentation

markdown

### 1. Edge TTS
```bash
npm install -g edge-tts
# 或者
pip install edge-tts

text

### Technical Analysis

The installation instructions direct users to install the latest package associated with the `edge-tts` name from either the npm or Python package registry. They do not identify an audited version, provide integrity hashes, use a lockfile, or clarify whether the packages in the two ecosystems are equivalent and trusted implementations.

The global npm installation option also increases the package's reach and may require elevated filesystem permissions. Because package registry contents can change after this skill has been reviewed, later installations may retrieve code different from the version originally assessed.

This finding establishes supply-chain exposure from unsafe dependency management; the reviewed files do not establish that the current registry packages are themselves malicious.

### Attack Path

1. A user follows the documented dependency installation instructions.
2. The package manager resolves the mutable package name to the version currently available from its registry.
3. If the selected package or a transitive dependency has been compromised, replaced, or published under a confusing package identity, installation or runtime hooks execute attacker-controlled code.
4. That code runs with the privileges of the installing user and may persist in the global package environment when global installation is used.

### Impact Assessment

A compromised dependency could execute code during installation or whenever the TTS command is invoked. The potential scope includes files, credentials, environment variables, and network access available to the installation or runtime account. Globa
...[truncated 72 chars]

Remediation

View remediation

Remediation Suggestions

• Identify one canonical, verified Edge TTS implementation and remove ambiguous alternatives.
• Pin an audited exact version rather than installing the latest release.
• For Python, use an isolated virtual environment and a hash-locked requirements file, such as pip install --require-hashes -r requirements.txt.
• For npm, use a project-local dependency, commit the lockfile, and install with npm ci; avoid global installation.
• Verify package publisher identity, repository ownership, release signatures where available, and transitive dependencies.
• Use automated dependency scanning and establish a controlled process for reviewing version updates.
• Avoid running package installation as root unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述只说“向指定 Telegram 群组发送语音消息”，但实际代码不仅发送语音，还会把输入文本动态生成为语音，并进行音频格式转换。这属于额外能力。代码还依赖本地 TTS 和媒体处理工具。另一个偏差是它根据传入的 sessionKey 发送到指定会话，示例是群组，但代码本身并未限制必须是群组。因此描述与实际行为部分一致，但不够准确完整，存在能力范围上的不匹配。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPENDENCIES.md (reported line 15)May include surrounding context.

2. FFmpeg

bash

# Ubuntu/Debian
sudo apt update
sudo apt install ffmpeg

# CentOS/RHEL/Fedora

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPENDENCIES.md (reported line 16)May include surrounding context.

2. FFmpeg

bash

# Ubuntu/Debian
sudo apt update
sudo apt install ffmpeg

# CentOS/RHEL/Fedora

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · DEPENDENCIES.md (reported line 19)May include surrounding context.

md

sudo apt install ffmpeg

# CentOS/RHEL/Fedora
sudo dnf install ffmpeg

# macOS
brew install ffmpeg

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The feature description specifies generating high-quality Chinese speech and a default Chinese voice, but it does not mention that language selection is optional or explain a justified region-specific scope. This can be a natural-language locale policy issue because it appears to force a specific language behavior without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly states the skill can send voice messages to arbitrary Telegram groups but provides no warning that user-provided content will be transmitted to an external messaging platform. This creates a real privacy and data-exfiltration risk because sensitive text may be converted to audio and sent outside the local environment without clear consent boundaries or destination restrictions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs users to grant the bot broad Telegram administrator permissions such as restricting members, banning members, and editing group info, which are unnecessary for sending voice messages. This violates least-privilege and materially increases the blast radius if the bot, its token, or the hosting environment is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation tells users to send group links/IDs and topic IDs to the bot without explaining that these identifiers disclose internal routing details about their Telegram groups. While not secret in all cases, collecting and transmitting them without a privacy warning can expose organizational structure or enable unintended access/configuration if users misunderstand what is being shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage instructions omit an explicit warning that any supplied message text will be processed for TTS and then transmitted to Telegram, a third-party platform. This can lead users to send sensitive or regulated content without understanding that it leaves the local/OpenClaw context and becomes available to external services and group participants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill enables sending user-provided content to external systems without a clear warning that message text will leave the local context and be transmitted to Telegram, and possibly to an external TTS service depending on edge-tts behavior. This can cause accidental disclosure of sensitive prompts, personal data, or internal information if users assume the operation is local-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states the skill uses Microsoft Edge-TTS to generate high-quality Chinese speech, and all examples hardcode a Chinese voice such as zh-CN-XiaoxiaoNeural. There is no indication that users can opt into another language or locale, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a narrowly scoped skill: sending voice messages to a specified Telegram group. However, this documentation promotes searching Reddit and Twitter, aggregating external content, and summarizing it before sending, which are distinct capabilities not inherently required to send Telegram voice messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill sends arbitrary provided text and generated voice media to a Telegram group, which is an external destination, without any built-in consent, confirmation, or data-sensitivity checks. In an agent setting, this can cause unintended disclosure of private or sensitive information if upstream inputs include confidential content or if the target groupId is misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code performs an outbound send operation to a Telegram group using the provided session key, which transmits user-supplied content to an external service. Although it prints progress messages, those messages do not warn the user that data will be sent externally or highlight the sensitivity of sending to a group destination.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents all user-facing instructions in Chinese, including headings and installation guidance, with no indication that users may choose another language. That can violate a language/locale policy when the skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example direct function call hard-codes the voice to zh-CN-XiaoxiaoNeural, which suggests a specific language/locale selection. The README does not state that users can choose another language/voice or that the Chinese locale is merely an example, creating a potential language-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该文件全文仅使用中文说明技能用法与操作步骤，没有提供用户可选择其他语言的提示，也没有说明该语言限制是面向特定区域或受众所必需。根据自然语言政策检查，这构成了未获用户选择即默认强制特定语言/locale 的情形。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The guidance recommends using the zh-CN-XiaoxiaoNeural voice specifically for natural Chinese pronunciation. This is a locale/language constraint presented as a best practice, but the document does not mention any user choice, fallback, or opt-in for other languages/locales.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function invokes external commands using exec to generate speech and convert audio files. While logging is present, there is no user-facing notice that the skill runs local subprocesses, which may matter for safety-sensitive environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written entirely in Chinese and provides no indication that the skill supports other languages or that it is intentionally limited to Chinese-speaking users. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script's user-facing messages and usage instructions are entirely in Chinese, which imposes a specific language on users without any opt-in or explanation of a region-specific requirement. This matches the policy concern for language or locale restrictions expressed in natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.