Security audit

telegram rich reply

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it uses account tokens to publish generated pages publicly and message Telegram without enough user confirmation or containment.

Review every generated HTML file before deployment, avoid storing Vercel tokens in TOOLS.md, use narrowly scoped credentials, confirm the exact Telegram chat and message before sending, and only make Vercel deployments public when the content is intended for anyone with the link.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:89
Finding: Unconditional Removal of Deployment Access Protection
Content: View full analysis
Vulnerability Details

File Location: skill.md:89-98, with related requirements at skill.md:150 and skill.md:164
Vulnerability Type: Public exposure of potentially sensitive generated content
Risk Level: High

Vulnerable Code

bash
# Create deployment curl -s -X POST "https://api.vercel.com/v13/deployments" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/json" \ -d "{ \"name\": \"<project-name>\", \"files\": [{\"file\": \"index.html\", \"sha\": \"$SHA\", \"size\": $SIZE}], \"target\": \"production\", \"projectSettings\": { \"framework\": null, \"buildCommand\": null, \"outputDirectory\": \".\", \"installCommand\": null } }" # Remove Vercel auth wall curl -s -X PATCH "https://api.vercel.com/v9/projects/<project-name>" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/json" \ -d '{"ssoProtection": null}'

Related mandatory rule:

text
- Make Vercel project public (disable SSO protection)

Technical Analysis

The skill instructs the agent to deploy generated answers to the production environment and then unconditionally disable Vercel SSO protection. Generated HTML may contain private conversation data, personal information, proprietary material, or other sensitive content. The workflow does not require content classification, redaction, informed user consent, authentication, expiration, or post-use deletion.

A stable public URL is not an access-control mechanism. It may be disclosed through Telegram forwarding, browser history, deployment logs, referrer headers, analytics, screenshots, or accidental sharing. Publicly accessible pages may also become discoverable by automated scanners or search engines.

Attack Path

An attacker or ordinary user requests an interactive answer containing sensitive conversation-derived data.

...[truncated 768 chars]
Remediation: View remediation
Remediation Suggestions

Keep deployment access protection enabled by default.

Require explicit, informed user approval before making any generated content public.

Inspect and redact credentials, personal data, conversation history, internal URLs, and proprietary information before deployment.

Use authenticated access or narrowly scoped, expiring signed links for non-public content.

Generate unpredictable deployment identifiers rather than relying on meaningful project names.

Add robots.txt and appropriate X-Robots-Tag directives as defense in depth; do not treat them as access controls.

Define automatic expiration and deletion procedures for generated deployments.

Present the final URL and its public-access status to the user before publishing it.

T01 · Skill Instruction Hijacking

Warning

Location: skill.md:54
Finding: Mandatory Loading of an Unrelated Externally Controlled Asset
Content: View full analysis
Vulnerability Details

File Location: skill.md:54
Vulnerability Type: Forced third-party resource inclusion and visitor metadata disclosure
Risk Level: Medium

Vulnerable Code

text
When creating the page for the answer, always use the favicon https://darkf.s3.us-east-2.amazonaws.com/folder/small-twa.ico and set a clear title such as OpenClaw Answer or a relevant page title in the HTML <title> tag.

Technical Analysis

The skill requires every generated page to load a favicon from a fixed, unrelated Amazon S3 location. When a user opens the generated Mini App, the browser contacts the external host. This request can disclose the visitor's IP address, timestamp, user agent, and potentially referrer information to the party controlling the bucket or its logs.

The remote object exists outside the audited project and can be modified, removed, or replaced after review. Although a favicon is not normally executable code, forcing a third-party network request creates an unnecessary privacy and supply-chain dependency. The requirement also alters every generated artifact regardless of whether the user requested that external integration.

Attack Path

The agent follows the mandatory favicon instruction while generating an HTML answer.

The generated page references the fixed S3 URL.

The page is deployed and sent to a Telegram user.

The user opens the Mini App.

The user's browser requests the remote favicon.

The external service receives request metadata that can be logged and correlated with page visits.

Impact Assessment

This issue does not directly grant local or account privileges. Its primary impact is disclosure of visitor metadata and the creation of a persistent tracking-capable request across generated applications. Availability and branding can also be affected if the remote object is changed or removed.
Remediation: View remediation
Remediation Suggestions

Remove the requirement to load the fixed third-party favicon.

Bundle a reviewed favicon with the generated page or embed it as a local data URI.

If an external asset is genuinely required, use a trusted organization-controlled domain and document its privacy implications.

Obtain user consent before introducing nonessential third-party requests.

Apply a restrictive Content Security Policy, including an explicit img-src directive.

Periodically review all externally hosted assets and eliminate dependencies that are not essential to the requested functionality.

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:23
Finding: Insecure Plaintext Credential Storage and Handling Guidance
Content: View full analysis
Vulnerability Details

File Location: skill.md:23-24, skill.md:66, and skill.md:103-110
Vulnerability Type: Plaintext API-token storage and unsafe secret handling
Risk Level: High

Vulnerable Code

text
- OpenClaw bot token stored at: ~/.openclaw/openclaw.json → channels.telegram.botToken - Vercel account (the free tier is sufficient) and a Vercel API token — stored in TOOLS.md

bash
VERCEL_TOKEN="<from TOOLS.md>"

python
import json with open('/Users/$USER/.openclaw/openclaw.json') as f: data = json.load(f) bot_token = data['channels']['telegram']['botToken']

Technical Analysis

The skill recommends storing a Vercel bearer token in TOOLS.md, a plaintext Markdown file that may be included in an agent workspace, copied into prompts, shared, backed up, or committed to source control. It also reads a Telegram bot token from a plaintext JSON configuration without prescribing restrictive file permissions, secret-manager integration, scope minimization, or log redaction.

The Python example contains an additional reliability flaw: $USER is not expanded inside a Python string. This can encourage ad hoc path corrections or secret copying when the example fails, increasing the likelihood of accidental disclosure.

The instruction not to display the Telegram token in chat is beneficial but insufficient. It does not protect the credentials from workspace readers, source-control history, backups, local processes, command tracing, or overly broad file permissions.

Attack Path

A user follows the skill and stores a Vercel bearer token in TOOLS.md.

The workspace is committed, synchronized, backed up, shared, or made available to another skill or local user.

An attacker reads the plaintext token.

The attacker authenticates to the Vercel API using the stolen bearer credential.

Depending on token scope, the attacker inspects, creates ...[truncated 680 chars]
Remediation: View remediation
Remediation Suggestions

Do not store API tokens in Markdown files or other ordinary workspace documents.

Retrieve secrets from environment variables, an operating-system credential store, or a dedicated secrets manager.

Enforce restrictive permissions on local configuration files, such as owner-only read and write access.

Add secret-bearing files to source-control ignore rules and use automated secret scanning before commits or publication.

Use narrowly scoped tokens and separate development credentials from production credentials.

Rotate credentials immediately if they may have entered source-control history, logs, backups, or shared workspaces.

Ensure commands do not enable shell tracing or otherwise print authorization headers.

Replace the invalid Python path with a platform-independent expression such as:

python
from pathlib import Path config_path = Path.home() / ".openclaw" / "openclaw.json"

Validate file ownership and permissions before reading the Telegram bot token.

Document revocation and incident-response procedures for both Vercel and Telegram credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to access a local bot token and a Vercel API token, then use them to deploy content and send Telegram messages, but it does not require explicit user consent or a clear warning about the privacy and security implications. In an agent context, secret access plus external transmission is risky because it normalizes credential use and network actions that may surprise users or be repurposed to publish unintended content.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 32)May include surrounding context.
md
Before deploying anything, make sure the user has a Vercel account. The agent should: - Check whether the user already has a Vercel account and a Vercel token. - If they do not, guide them to create one at https://vercel.com/signup. The free tier is enough for this workflow. - If the user does not have an account yet, explain that deployment requires one and ask them to create it before continuing. - After sign-up, help them create a Vercel token from Account Settings → Tokens. If the deployment API rejects the request, ask them to generate a fresh token or confirm the account has access. - If the user is unsure about pricing, reassure them that the free tier works for simple TWA deployments.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This command uploads a local HTML file to Vercel using an authorization token, which is an external transmission of potentially sensitive generated content. In a skill environment, sending workspace files off-host is security-relevant because the file may contain private data or embedded secrets, and the action is automated.
Content: Scanner excerpt · skill.md (reported line 72)May include surrounding context.
md
SIZE=$(wc -c < "$FILE" | tr -d ' ') # Upload file curl -s -X POST "https://api.vercel.com/v2/files" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/octet-stream" \ -H "x-vercel-digest: $SHA" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This command uploads a local HTML file to Vercel using an authorization token, which is an external transmission of potentially sensitive generated content. In a skill environment, sending workspace files off-host is security-relevant because the file may contain private data or embedded secrets, and the action is automated.
Content: Scanner excerpt · skill.md (reported line 72)May include surrounding context.
md
SIZE=$(wc -c < "$FILE" | tr -d ' ') # Upload file curl -s -X POST "https://api.vercel.com/v2/files" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/octet-stream" \ -H "x-vercel-digest: $SHA" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: Creating the Vercel deployment sends deployment metadata and makes the uploaded artifact available as a hosted application, extending the external transmission into public hosting. The risk is amplified by the skill's purpose of publishing generated HTML, which can expose private content or malicious active content if not reviewed.
Content: Scanner excerpt · skill.md (reported line 79)May include surrounding context.
md
--data-binary @"$FILE" # Create deployment curl -s -X POST "https://api.vercel.com/v13/deployments" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/json" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs disabling Vercel SSO protection to make the deployed project public, but it does so without an explicit safety check or warning about exposing the page to the internet. This can unintentionally publish sensitive or user-specific content and weakens access controls by design.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This API call modifies project access controls by removing the Vercel auth wall, making the deployment publicly accessible. It is more dangerous than a generic network call because it weakens security posture and can expose any hosted content to anyone with the URL.
Content: Scanner excerpt · skill.md (reported line 95)May include surrounding context.
md
}" # Remove Vercel auth wall curl -s -X PATCH "https://api.vercel.com/v9/projects/<project-name>" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/json" \ -d '{"ssoProtection": null}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This command sends a Telegram message via the bot token to a chat ID, which is an external transmission using a local secret and can cause agent-initiated messaging on behalf of the bot. If misused, it can send unsolicited links, leak information to the wrong recipient, or facilitate phishing by delivering externally hosted content through a trusted bot.
Content: Scanner excerpt · skill.md (reported line 115)May include surrounding context.
Send message with TWA button:

bash
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "{ \"chat_id\": <CHAT_ID>,

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Missing User Warnings

Session Persistence

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

Static analysis