ClawHub
Back to skill

Security audit

Create Agent With Telegram Group

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provisions a persistent OpenClaw agent and Telegram group, with expected local configuration changes and some manageable local-file safety risks.

Install this only if you want a lasting OpenClaw agent bound to a Telegram group that can respond without being mentioned. Review the generated config backup permissions, keep the dedicated group limited to trusted participants, and remove the binding, workspace, and backup files manually if you later deprovision the agent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/provision_config.py:104
Finding

Configuration Backup May Expose Sensitive Data Through Insecure File Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/provision_config.py, lines 104–105
Vulnerability Type: Insecure creation of a sensitive configuration backup
Risk Level: Medium

Vulnerable Code

python
backup_path = f"{config_path}.bak.{ts}"
Path(backup_path).write_text(Path(config_path).read_text(encoding="utf-8"), encoding="utf-8")

Technical Analysis

The script copies the complete OpenClaw configuration into a newly created backup file using Path.write_text(). The permissions assigned to that new file are determined by the process umask rather than inherited from the original configuration.

If the source openclaw.json has restrictive permissions such as 0600, a typical umask of 022 may cause the backup to be created with permissions such as 0644. Because the configuration may contain authentication tokens, API credentials, Telegram configuration, or other sensitive settings, this can expose protected information to other local users.

The timestamped filename does not provide a security boundary. Backup files also remain on disk after provisioning, increasing the period during which sensitive data could be recovered.

Attack Path

  1. The victim has a sensitive ~/.openclaw/openclaw.json protected with restrictive permissions.
  2. The victim runs scripts/provision_config.py without the --no-backup option.
  3. The script reads the complete configuration and creates a timestamped backup using Path.write_text().
  4. The backup receives permissions derived from the current umask rather than the source file's restrictive permissions.
  5. Another local user enumerates the predictable openclaw.json.bak.* files.
  6. If the resulting mode permits access, that user reads credentials or other sensitive configuration values from the backup.

Impact Assessment

Exploitation requires local access to the same host and filesystem permissions sufficient to traverse the relevant direct ...[truncated 432 chars]

Remediation
View remediation

Remediation Suggestions

  • Create backup files with an explicitly restrictive mode such as 0600, independent of the process umask.
  • Alternatively, use shutil.copy2() to preserve source metadata and then explicitly verify or tighten the resulting mode.
  • Use atomic creation with exclusive semantics to avoid overwriting an existing path or following a pre-created symbolic link.
  • Open the destination with flags such as O_CREAT, O_EXCL, and, where supported, O_NOFOLLOW.
  • Write to a securely created temporary file in the same directory, flush and synchronize it, and atomically rename it into place.
  • Restrict backup retention and securely remove obsolete copies.
  • Verify that both the configuration directory and all backup files are inaccessible to unrelated local accounts.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init_workspace.py:14
Finding

Workspace Initialization Follows Symbolic Links and Can Overwrite Files Outside the Workspace

Content
View full analysis

Vulnerability Details

File Location: scripts/init_workspace.py, lines 14–18
Vulnerability Type: Symbolic-link file overwrite
Risk Level: Medium

Vulnerable Code

python
def write_if(path: Path, content: str, enabled: bool):
    if not enabled:
        return False
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(content, encoding="utf-8")
    return True

The vulnerable function is called for fixed workspace filenames at lines 36–46:

python
if write_if(ws / "USER.md", "# USER.md\n\n- Name: <fill-me>\n- What to call them: <fill-me>\n- Preferred language: <fill-me>\n- Goals: <fill-me>\n", args.with_user):
    created.append("USER.md")

if write_if(ws / "IDENTITY.md", f"# IDENTITY.md\n\n- Name: {args.agent_name}\n- Role: Dedicated assistant\n", args.with_identity):
    created.append("IDENTITY.md")

soul = f"# SOUL.md\n\nYou are {args.agent_name}.\nBe concise, useful, and reliable.\n"
if write_if(ws / "SOUL.md", soul, args.with_soul):
    created.append("SOUL.md")

Technical Analysis

The script resolves and validates the workspace directory as being under the current user's home directory. However, it does not validate the final destination files immediately before writing them.

Path.write_text() follows symbolic links. Therefore, a pre-existing USER.md, IDENTITY.md, or SOUL.md symbolic link can resolve to a file outside the validated workspace. The target file is opened for writing and truncated before the generated content is stored.

This is a time-of-check/time-of-use and symbolic-link handling weakness: validating the parent workspace does not guarantee that a child pathname still resolves within that workspace when the write occurs.

Attack Path

  1. An attacker obtains write access to an existing workspace or can prepare the workspace before initialization.
  2. The attacker creates one of the expected des ...[truncated 1107 chars]
Remediation
View remediation

Remediation Suggestions

  • Reject an existing destination if path.is_symlink() is true.
  • Resolve each destination immediately before writing and verify that it remains beneath the resolved workspace.
  • Avoid check-then-write logic as the sole defense because the path can change between those operations.
  • Open destination files using no-follow semantics, such as O_NOFOLLOW where supported.
  • Use exclusive creation where overwriting is unnecessary.
  • For intentional updates, create a secure temporary file within the validated workspace and atomically replace a verified regular destination.
  • Verify that the workspace and its parent directories are owned by the expected user and are not writable by untrusted accounts.
  • Refuse to write when the destination is not a regular file or when any relevant path component is an untrusted symbolic link.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The skill provisions persistent infrastructure: a dedicated Telegram group, a workspace under the user's home directory, and durable updates to ~/.openclaw/openclaw.json that bind the agent to that group. Even with confirmation prompts, this creates lasting session/state persistence that could be abused to maintain ongoing communication channels or reintroduce an agent after the initial interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: create-agent-with-telegram-group
description: Create a new OpenClaw agent and bind it to a dedicated Telegram group with workspace ~/claw-<agent-name>. Use when the user asks for one-agent-one-group setup, Telegram group binding, or repeatable agent provisioning. Always ask which model to use, ask for essential initialization choices (USER.md/IDENTITY.md/SOUL.md), and set group reply mode to no-mention-required. Explicit user confirmation is required before any high-privilege actions: modifying openclaw.json, triggering browser automation, or restarting the gateway.
---

# Agent Create + Dedicated Telegram Group

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script unconditionally sets channels.telegram.groups.<chat_id>.requireMention = False, which broadens when the Telegram-bound agent will respond in a group. In a skill that provisions persistent chat bindings and edits user config, disabling mention gating without explicit opt-in can cause unintended triggering, message exposure to the agent, and increased risk of misuse or prompt injection from any group participant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script creates a workspace directory and rewrites ~/.openclaw/openclaw.json, which are safety-relevant file modifications. While the final print reports what changed and backups may be created, there is no confirmation prompt or pre-write disclosure in comments/docstrings/help describing that the user's config will be modified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The instructions explicitly collect a language field for USER.md, but the skill does not state that the user may choose their preferred language/locale for interaction or explain any locale-specific limitation. Because SQP-3 covers language or locale policy concerns in natural-language instructions, this is a minor policy gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.