ClawHub
Back to skill

Security audit

telegram rich reply

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it can publish generated content publicly and change Vercel access settings without a clear confirmation step.

Install only if you intend the generated HTML answer to be hosted on Vercel and reachable by Telegram users. Review the page for secrets, personal data, internal links, or confidential content before deployment, and use a dedicated Vercel project/token if possible because the skill changes public access settings.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to read a local Telegram bot token from the user's filesystem, which is a sensitive credential access action not clearly disclosed by the skill's stated purpose. Even if the token is not shown in chat, retrieving and using local secrets expands the skill's authority and creates risk of credential misuse, exfiltration, or unauthorized messaging if the skill or downstream prompts are compromised.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill instructs disabling Vercel SSO protection to make deployments public, which weakens access controls beyond the narrow goal of rendering a Telegram Mini App. Making the project publicly accessible can expose uploaded HTML and associated content to unintended audiences and increases the blast radius if sensitive data is ever included in the deployment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instructions describe sending a Telegram message but understate two important behaviors: uploading generated HTML to an external service and explicitly making the deployment public by removing SSO protection. This is a transparency and consent failure that can mislead users about where their content goes and who can access it.

External Transmission

Medium
Category
Data Exfiltration
Content
}"

# Remove Vercel auth wall
curl -s -X PATCH "https://api.vercel.com/v9/projects/<project-name>" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ssoProtection": null}'
Confidence
84% confidence
Finding
This API call is not just external transmission; it changes project security posture by removing the Vercel auth wall (`ssoProtection: null`). In context, that action materially increases exposure and should be treated as a real security issue rather than a routine outbound request.

Static analysis

No suspicious patterns detected.