Security audit

Agent Scout

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed research-agent setup, but it grants remote Telegram access and broad shared workspace/memory access in ways users should review before installing.

Before installing, replace the Telegram allowlist with your own verified user ID, avoid placing the bot token directly in shell history, use a Scout-specific workspace and memory namespace, and only enable memory/search/session tools that Scout actually needs. Treat Telegram messages and OpenAI-backed memory search as external data flows.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:31
Finding: Hard-Coded External Telegram Account Receives Agent Access
Content: View full analysis
" openclaw config set channels.telegram-scout.dmPolicy "allowlist" openclaw config set channels.telegram-scout.allowFrom '["8646359939"]' ``` ### Technical Analysis The configuration authorizes the fixed Telegram user ID `8646359939` without explaining its ownership or requiring the installer to replace and verify it. A research assistant does not need access to a predetermined third-party Telegram account to perform its declared functionality. Although the direct-message policy is set to `allowlist`, the protection is only effective if every listed identity belongs to an intended operator. Hard-coding an unidentified account violates least privilege and may expose the agent to an external principal. This risk is amplified by the other permissions granted to Scout, including web access, shared workspace access, memory retrieval, and inter-agent communication. ### Attack Path 1. An installer follows the documented commands without replacing the hard-coded Telegram ID. 2. OpenClaw enables the Scout Telegram channel and authorizes account `8646359939`. 3. The party controlling that account sends commands to the Scout bot. 4. Scout processes those commands using its permitted tools and accessible data. 5. The controller may obtain research results, memory-derived information, or data available through inter-agent communication. ### Impact Assessment An unintended Telegram account may gain remote command access to Scout. The accessible scope potentially includes: - Web search and web retrieval capabilities. - Information available in Scout's configured workspace. - Data exposed through `memory_search` and `memory_get ...[truncated 322 chars]
Remediation: View remediation
`. - Require the installer to obtain the ID from their own authenticated Telegram account. - Add an ownership-verification step before enabling the channel. - Display and review the effective allowlist during installation. - Start with the Telegram channel disabled and require an explicit enablement action. - Restrict authorized users to individually verified operators. - Periodically audit the allowlist and immediately remove stale or unidentified accounts. - Document how to revoke access and rotate the bot token if unauthorized control is suspected. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:49
Finding: Research Agent Receives Excessive Shared Workspace and Memory Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:33
Finding: Telegram Bot Token Is Supplied Through a Command-Line Argument
Content: View full analysis
" ``` ### Technical Analysis The instructions encourage the installer to substitute a Telegram bot token directly into a shell command. Secrets provided this way may be exposed through: - Interactive shell history. - Terminal session recording. - Process command-line inspection while the command runs. - Automation, deployment, or CI logs. - Copy-and-paste records and troubleshooting transcripts. The file contains only a placeholder and does not itself disclose a real credential. The vulnerability arises from the prescribed handling method when the placeholder is replaced with a real token. ### Attack Path 1. The installer replaces `` with the actual Telegram bot token. 2. The command is executed in an interactive shell or logged automation environment. 3. The token is retained in shell history, logs, or observable process arguments. 4. A local user, support operator, log reader, or compromised process obtains the token. 5. The exposed token is used to access or impersonate the Telegram bot through the Telegram Bot API. ### Impact Assessment A disclosed bot token may allow an attacker to impersonate or operate the bot within the permissions provided by Telegram's Bot API. This can undermine the integrity and confidentiality of the Telegram integration and may facilitate deceptive messages or unauthorized bot activity. The exact impact depends on Telegram's API behavior, existing bot configuration, and whether the token is promptly revoked. This issue does not by itself grant host-level code execution. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
## Testing Procedure 1. **Telegram Test**: Send message to @scout_research_bot 2. **Research Test**: Ask "Research solar panel efficiency trends 2026" 3. **Skill Test**: Request "Find skills for data visualization" 4. **Collaboration Test**: Ask to coordinate with Lourens

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill provisions a Telegram bot, requires a bot token, and enables communication with an external third-party platform without any explicit warning about credential handling, data exposure, or trust boundaries. This can lead operators to paste secrets into commands or route potentially sensitive conversations through Telegram without understanding the privacy and security implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables memory search and points it at an external provider (openai) while also granting workspace access, but it does not warn that local content may be indexed, embedded, or transmitted off-host. In a research assistant context, this could unintentionally expose sensitive workspace data, notes, or proprietary material to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest and documentation describe Scout as a research assistant with web search, web fetch, memory search, and skill discovery capabilities, and those tools are initially enabled at L048-L055. However, L069 sets the same agents.list.scout.tools.allow key to only ["sessions_send"], which would replace the earlier research-tool configuration rather than add to it, leaving the agent without the documented research tooling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file repeatedly specifies that Scout is female and uses she/her pronouns as a fixed requirement. This is a natural-language policy concern because it imposes a language/identity choice without offering customization or user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.