ClawHub
Back to skill

Security audit

Notify Bot

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends user-specified Telegram bot notifications, but users should treat it as a credentialed posting tool.

Install only if you intend agents or users to send Telegram messages using locally configured bot tokens. Restrict who can invoke it, use only low-privilege bot tokens, verify allowed bot names and group IDs, and consider fixing the curl token-in-command-line exposure before using it in a shared environment.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
notify_bot.sh:42
Finding

Telegram Bot Token Exposed in Process Command-Line Arguments

Content
View full analysis
/cmdline`, another local process with sufficient process-inspection privileges may capture the token. The exposure window is short, but repeated executions or automated monitoring can make exploitation practical. Retrieving a Telegram token from the keychain is necessary for the Skill's declared notification functionality. The keychain access at lines 30–32 is limited to documented Telegram token names and does not, by itself, exceed the required privilege. The vulnerability arises from how the retrieved secret is subsequently passed to `curl`. ### Attack Path 1. A user legitimately invokes `notify_bot.sh`. 2. The script retrieves the selected bot's token from the OpenClaw keychain. 3. The script expands `$TOKEN` into the Telegram API URL used as a `curl` command-line argument. 4. While `curl` is running, a malicious local process repeatedly inspects process argument lists. 5. The malicious process captures a URL containing the Telegram bot token. 6. The attacker reuses the token to authenticate directly to the Telegram Bot API. This attack requires local process-inspection access. It does not provide a remote exploitation path by itself. ### Impact Assessment A captured token allows an attacker to impersonate the affected Telegram bot and invoke Bot API methods a ...[truncated 647 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

This script accesses bot tokens from a local keychain based directly on a user-supplied bot name, then immediately uses those credentials to perform actions on an external service. In an agent skill setting, that is dangerous because it exposes a credentialed action surface: an untrusted caller may be able to select any configured bot identity and send messages without additional authorization checks.

Content

Scanner excerpt · notify_bot.sh (reported line 30)May include surrounding context.

sh
# vision 的 key 是 openclaw.telegram.vision.token，其他是 .bot_token
  if [ "$bot_name" = "vision" ]; then
    TOKEN=$(~/.openclaw/tools/keychain.sh get "openclaw.telegram.vision.token" 2>/dev/null || echo "")
  else
    TOKEN=$(~/.openclaw/tools/keychain.sh get "openclaw.telegram.${bot_name}.bot_token" 2>/dev/null || echo "")
  fi

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The non-vision branch also fetches a bot token from the keychain using a key derived from untrusted input, enabling credential-backed actions under arbitrary configured bot identities. Even though the token value is not printed, the ability to access and use it is itself sensitive and can be abused for impersonation, spam, or exfiltration via Telegram.

Content

Scanner excerpt · notify_bot.sh (reported line 32)May include surrounding context.

sh
if [ "$bot_name" = "vision" ]; then
    TOKEN=$(~/.openclaw/tools/keychain.sh get "openclaw.telegram.vision.token" 2>/dev/null || echo "")
  else
    TOKEN=$(~/.openclaw/tools/keychain.sh get "openclaw.telegram.${bot_name}.bot_token" 2>/dev/null || echo "")
  fi
  
  if [ -z "$TOKEN" ]; then

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions, usage notes, and warnings are all presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script retrieves Telegram bot tokens from a local keychain and uses them to authenticate outbound API calls. Although the file has basic usage comments and status output, it does not explicitly disclose that credential material will be accessed, which is a safety-relevant operation for code files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The script transmits user-supplied message content and bot-authenticated requests to Telegram, an external third party. In a skill context, this is security-relevant because anyone able to invoke the script can cause data to leave the local environment and can send messages as any locally configured bot name, creating a risk of unauthorized data exfiltration or misuse of bot identity.

Content

Scanner excerpt · notify_bot.sh (reported line 41)May include surrounding context.

sh
fi
  
  # 发送任务消息
  RESULT=$(curl -s -X POST "https://api.telegram.org/bot$TOKEN/sendMessage" \
    -d "chat_id=$GROUP_ID" \
    -d "message_thread_id=$TOPIC_ID" \
    -d "text=$MESSAGE")

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The script transmits user-supplied message content and bot-authenticated requests to Telegram, an external third party. In a skill context, this is security-relevant because anyone able to invoke the script can cause data to leave the local environment and can send messages as any locally configured bot name, creating a risk of unauthorized data exfiltration or misuse of bot identity.

Content

Scanner excerpt · notify_bot.sh (reported line 41)May include surrounding context.

sh
fi
  
  # 发送任务消息
  RESULT=$(curl -s -X POST "https://api.telegram.org/bot$TOKEN/sendMessage" \
    -d "chat_id=$GROUP_ID" \
    -d "message_thread_id=$TOPIC_ID" \
    -d "text=$MESSAGE")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This manifest description says the skill sends Telegram bot notifications and activates a group session, but it does not define specific trigger phrases, invocation conditions, or exclusion conditions. In a manifest file, this kind of broad natural-language description can cause ambiguous or unintended activation because the scope of when the skill should run is not clearly bounded.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script's human-facing comments, usage instructions, and examples are entirely in Chinese, with no indication that the locale is optional or intentionally restricted to a specific audience. This can violate language/locale policy when no user opt-in or documented justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The user-facing natural-language fields are written only in Chinese, which may impose a language choice without offering user opt-in or documenting a locale-specific purpose. The file does not indicate that this skill is intended only for Chinese-speaking users or a region-specific workflow.

Content

No source excerpt is available for this finding.