ClawHub
Back to skill

Security audit

Telegram Autopilot

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it takes broad control of a Telegram account and handles private messages and login secrets in ways users should review carefully.

Install only if you are comfortable giving this skill a reusable Telegram session that can read private chats and send messages as you. Use a dedicated or low-risk Telegram account, tightly limit the contact whitelist, avoid command-line or plaintext-file 2FA handling, protect config.json and .session files, disable owner notifications unless needed, and review each paid-media action before running it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.py:17
Finding

Insecure Handling of Telegram OTP and 2FA Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/autopilot.py:24
Finding

Private Telegram Conversations Stored in Plaintext

Content
View full analysis
Autopilot\nFrom: {sender_name}\nMsg: {msg_text[:200]}") if username not in history: history[username] = [] history[username].append({"role": "user", "text": msg_text, "ts": datetime.now(timezone.utc).isoformat()}) # Mark as read await client.send_read_acknowledge(event.chat_id, event.message) await asyncio.sleep(2) try: reply = await generate_reply(config, sender_name, username, msg_text, history) except Exception as e: log(f"AI error: {e}") return if not reply: return # Typing simulation async with client.action(event.chat_id, "typing"): await asyncio.sleep(min(len(reply) * 0.05, 5)) await client.send_message(event.chat_id, reply) log(f"REPLY to {sender_name}: {reply[:100]}") history[username].append({"role": "assistant", "text": reply, "ts": datetime.now(timezone.utc).isoformat()}) if len(history[username]) > 50: history[username] = history[username][-30:] save_history(history_path, history) ``` ### Technical Analysis Incoming private messages and generated replies are persisted in `conversations.json`. The file is created using ordinary `open(path, "w")`, so its effective permissions depend on the process umask. The code does not explicitly enforce owner-only access, encrypt records, support disabling persistence, or provide secure deletion. Although the history is truncated after it exceeds 50 entries, up to 30 entries are retained af ...[truncated 1005 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/autopilot.py:67
Finding

Prompt Injection Can Override Autopilot Persona and Reply Constraints

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/autopilot.py:37
Finding

Unescaped Telegram HTML in Owner Notifications

Content
View full analysis
Autopilot\nFrom: {sender_name}\nMsg: {msg_text[:200]}") ``` `scripts/autopilot.py:197` ```python await notify(config, f"💬 Reply to {sender_name}:\n{reply[:200]}") ``` ### Technical Analysis The notification request enables Telegram’s HTML parsing while interpolating contact-controlled message text and AI-generated replies without escaping. Supported markup can change how the notification is rendered, including the appearance and destination of links. Invalid or unbalanced markup can also cause Telegram’s Bot API to reject the notification. The contact display name is taken from local configuration, while `msg_text` is directly controlled by the whitelisted sender. Generated replies may also contain markup originating from prompt-injected content. ### Attack Path 1. A whitelisted contact sends a message containing Telegram-supported HTML markup or malformed tags. 2. The application inserts the raw message into a notification with `parse_mode` set to `HTML`. 3. Telegram interprets the attacker-controlled markup rather than displaying ...[truncated 555 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (29)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The skill explicitly supports forwarding every incoming message and generated reply to an owner-controlled bot/chat. That creates a built-in exfiltration path for private Telegram communications, and if the bot token or owner chat is misconfigured or compromised, sensitive conversations can be leaked without the correspondents' knowledge.

Content

Scanner excerpt · README.md (reported line 153)May include surrounding context.

md
- **Never commit** `config.json` (contains API keys) or `.session` files
- **OTP server** binds to `127.0.0.1` only — never expose it to the network
- **Transparency:** If someone directly asks if they're talking to AI, the bot is honest
- **Notifications** forward messages to the owner — ensure you control the bot token
- Telegram may restrict accounts with aggressive automation — natural delays are built in
- Only one process can use a session file at a time
- Using a userbot may violate Telegram ToS — use at your own risk

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to manage AI auto-replies, but the documented capabilities also include channel-based paid media posting and invite-link distribution, which are outside the narrow expectation of message autopilot behavior. This mismatch broadens the operational scope toward account actions and monetization flows that could surprise users and increase abuse potential if invoked unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to manage AI auto-replies, but the documented capabilities also include channel-based paid media posting and invite-link distribution, which are outside the narrow expectation of message autopilot behavior. This mismatch broadens the operational scope toward account actions and monetization flows that could surprise users and increase abuse potential if invoked unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill can send messages and media as the user and conceal that responses are automated, yet the opening description does not prominently warn about impersonation and autonomous account actions. That omission increases the likelihood of uninformed consent and unsafe use in sensitive personal conversations.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
98% confidence
Finding

The documented ability to forward messages to the owner via bot is an explicit exfiltration path for private Telegram content. In the context of a personal-account autopilot, this is especially sensitive because the skill operates on direct messages and can silently relay conversations outside the participants' expectations.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
- **Session security:** The `.session` file grants full access to the account. Protect it like a password.
- **Transparency:** The AI is instructed to be honest if directly asked whether it's AI.
- **OTP server:** `code_server.py` binds to `127.0.0.1` (localhost only). Never expose it to the network.
- **Notifications:** The skill can forward messages to the owner via bot. Ensure you control the bot token and chat_id.
- **Rate limits:** Telegram may restrict accounts with aggressive automation. The autopilot uses natural delays.
- **One session at a time:** Only one process can use a session file. Stop autopilot before running other scripts.
- **Platform policies:** Using a userbot to auto-reply may violate Telegram ToS. Use at your own risk.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function builds prompts that include up to 10 prior conversation entries and then submits them to an external model provider, causing cumulative disclosure of private conversations. This increases exposure beyond the latest message and can leak sensitive historic context, personal data, or confidential discussions to third-party AI services.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code copies incoming private messages into a separate owner notification channel using a bot, disclosing message contents beyond the original one-to-one chat. This creates a confidentiality breach because sensitive messages from contacts are duplicated to another chat and also exposed to Telegram Bot API processing.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The workflow is explicitly designed to read authentication factors from predictable files (enter_code.txt and enter_password.txt) in a user-supplied working directory. This constitutes credential materialization on disk, which expands the attack surface through local file disclosure, accidental backup/sync, race conditions, or misuse of an insecure/shared workdir. In this skill’s context, the secrets grant access to a Telegram account that will act as the user, making the exposure more dangerous than a generic temporary token leak.

Content

Scanner excerpt · scripts/setup.py (reported line 19)May include surrounding context.

python
async def main(args):
    session_path = os.path.join(args.workdir, args.session)
    code_file = os.path.join(args.workdir, "enter_code.txt")
    pw_file = os.path.join(args.workdir, "enter_password.txt")

    for f in (code_file, pw_file):
        if os.path.exists(f):

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script prints the one-time login code directly to stdout with GOT_CODE: {code}. OTPs are authentication secrets, and stdout is commonly captured by terminals, logs, orchestration tools, agent transcripts, or monitoring systems, so this unnecessarily exposes a live credential that can be reused during the login window. In the context of a Telegram userbot that authenticates as the user, leakage can enable full account takeover during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script accepts the Telegram 2FA password via a command-line argument or plaintext file polling. Command-line arguments may be visible to other local users through process listings and shell history, and plaintext files in a shared or weakly permissioned working directory can be read by other processes or retained after use. Because this skill manages a personal Telegram account, compromise of the 2FA password materially increases the risk of account takeover.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README describes AI auto-replies and provider configuration, but it does not clearly warn that private Telegram message contents and conversation context are sent to external AI providers for processing. In a personal messaging autopilot, that omission is security-relevant because users may unknowingly expose sensitive conversations, contacts, and metadata to third parties.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares no explicit tool scope even though it clearly instructs network access and local file writes. In an agent environment, missing scope boundaries can cause the skill to be invoked with broader-than-expected capabilities, increasing the chance of unintended credential handling, file modification, or network activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Trigger phrases like 'manage my telegram' and 'respond for me' are broad enough to match ordinary user requests that may not imply consent to impersonation, account automation, or credential use. In an agent system, overly broad routing can activate a high-impact skill in the wrong context and lead to unintended message sending or secret collection.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Forwarding incoming private messages and sent replies to an owner-controlled bot creates a secondary disclosure channel for personal chat content. Even if intended for monitoring, this duplicates sensitive communications outside the original chat context and can expose correspondents' data, secrets, and private conversations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Storing the Telegram API credentials, phone-related login context, AI API key, and optional bot token together in a plain config.json centralizes multiple high-value secrets in one file. Compromise of that file can enable account takeover, AI API abuse, and monitoring-channel abuse all at once, increasing blast radius significantly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autopilot.py (reported line 44)May include surrounding context.

python
chat_id = notif.get("chat_id")
    if not token or not chat_id:
        return
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    data = json.dumps({"chat_id": chat_id, "text": text, "parse_mode": "HTML"}).encode()
    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})
    try:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code selects a language from contact configuration and instructs the model to reply in that language, which imposes a locale choice on the conversation without any visible user choice or opt-in mechanism. This matches the policy concern for language or locale constraints that are forced rather than offered.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autopilot.py (reported line 100)May include surrounding context.

python
"messages": messages,
        }).encode()
        req = urllib.request.Request(
            "https://api.anthropic.com/v1/messages",
            data=payload,
            headers={
                "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 132)May include surrounding context.

md
headers = {"Content-Type": "application/json"}
        if ai.get("api_key"):
            headers["Authorization"] = f"Bearer {ai['api_key']}"
        req = urllib.request.Request(ai.get("base_url", "https://api.openai.com/v1/chat/completions"), data=payload, headers=headers)
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read())
            return result["choices"][0]["message"]["content"].strip()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autopilot.py (reported line 122)May include surrounding context.

python
headers = {"Content-Type": "application/json"}
        if ai.get("api_key"):
            headers["Authorization"] = f"Bearer {ai['api_key']}"
        req = urllib.request.Request(ai.get("base_url", "https://api.openai.com/v1/chat/completions"), data=payload, headers=headers)
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read())
            return result["choices"][0]["message"]["content"].strip()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The handler forwards private message content to an external AI provider to generate a reply, but this file contains no explicit user-facing consent, notice, or minimization before transmitting third-party message data off-platform. In a Telegram userbot context, this is a real privacy/security issue because private correspondents may not expect their messages to be sent to Anthropic/OpenAI-compatible services.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated reply is copied to the notification channel, leaking derivative conversation content to an additional destination outside the original chat. While this may be intended for monitoring, it still expands access to potentially sensitive communications and can reveal inferred private details from the exchange.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The OTP code is persisted to a plaintext file on disk, which unnecessarily extends the lifetime of a highly sensitive authentication secret beyond the login flow. On a multi-user system, shared workspace, synced folder, or compromised host, another process or user could read the file and use the code during the valid window, and the page also reflects the code back in the response, increasing accidental disclosure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This script performs actions outside the advertised autopilot scope by creating a private Telegram channel, posting paid media, exporting an invite link, and sending that link to another user. In a skill that already requires full Telegram user credentials, this scope expansion increases the chance of unauthorized account actions and deceptive or unintended outreach as the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script performs irreversible or externally visible actions—creating a channel, posting media, exporting an invite, and messaging a target—without any confirmation step or warning. In the context of a Telegram userbot with account-level access, this makes accidental misuse, social engineering, or abuse through automation materially more dangerous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.