ClawHub
Back to skill

Security audit

Telegram Bot Builder

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Telegram Bot API helper, with expected token use and bot-management actions, but users should handle bot tokens and chat data carefully.

Install only for bots you control. Store TELEGRAM_BOT_TOKEN as a secret, avoid pasting expanded token URLs into shared logs or terminals, rotate the token if exposed, and be careful with update logs, forwarded messages, location data, and moderation commands because they can affect real users and reveal personal information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation repeatedly places the bot token directly in request URLs, which can leak via shell history, process listings, terminal logs, proxies, or copied command output. While this is common in simple API examples, omitting any warning or safer pattern increases the chance that users will expose a credential that grants full control of the bot.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill shows retrieval of updates and forwarding of messages without warning that these payloads may contain personal data, chat metadata, usernames, and message contents. In a bot-management skill, this can normalize indiscriminate collection or redistribution of user communications without considering consent, retention, or least-privilege handling.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The documentation includes ban and unban moderation actions with no caution about authorization, auditability, or the risk of accidental or abusive account moderation. Although these are legitimate API features, exposing destructive actions without safeguards can lead to misuse or unintended service disruption in groups and channels.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill demonstrates sending location data and requesting a user's location without warning that geolocation is highly sensitive personal information. In practice, this can encourage collection or sharing of precise user whereabouts without adequate notice, consent, or retention controls.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.