Agent Scout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed research-agent setup, but it grants remote Telegram access and broad shared workspace/memory access in ways users should review before installing.

Before installing, replace the Telegram allowlist with your own verified user ID, avoid placing the bot token directly in shell history, use a Scout-specific workspace and memory namespace, and only enable memory/search/session tools that Scout actually needs. Treat Telegram messages and OpenAI-backed memory search as external data flows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:31
• Finding: Hard-Coded External Telegram Account Receives Agent Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-35 **Vulnerability Type**: Hard-coded external authorization principal **Risk Level**: High ### Vulnerable Code ```bash # Configure Telegram channel openclaw config set channels.telegram-scout.enabled true openclaw config set channels.telegram-scout.botToken "<BOT_TOKEN>" openclaw config set channels.telegram-scout.dmPolicy "allowlist" openclaw config set channels.telegram-scout.allowFrom '["8646359939"]' ``` ### Technical Analysis The configuration authorizes the fixed Telegram user ID `8646359939` without explaining its ownership or requiring the installer to replace and verify it. A research assistant does not need access to a predetermined third-party Telegram account to perform its declared functionality. Although the direct-message policy is set to `allowlist`, the protection is only effective if every listed identity belongs to an intended operator. Hard-coding an unidentified account violates least privilege and may expose the agent to an external principal. This risk is amplified by the other permissions granted to Scout, including web access, shared workspace access, memory retrieval, and inter-agent communication. ### Attack Path 1. An installer follows the documented commands without replacing the hard-coded Telegram ID. 2. OpenClaw enables the Scout Telegram channel and authorizes account `8646359939`. 3. The party controlling that account sends commands to the Scout bot. 4. Scout processes those commands using its permitted tools and accessible data. 5. The controller may obtain research results, memory-derived information, or data available through inter-agent communication. ### Impact Assessment An unintended Telegram account may gain remote command access to Scout. The accessible scope potentially includes: - Web search and web retrieval capabilities. - Information available in Scout's configured workspace. - Data exposed through `memory_search` and `memory_get ...[truncated 322 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the fixed ID with an explicit placeholder such as `<OWNER_TELEGRAM_USER_ID>`. - Require the installer to obtain the ID from their own authenticated Telegram account. - Add an ownership-verification step before enabling the channel. - Display and review the effective allowlist during installation. - Start with the Telegram channel disabled and require an explicit enablement action. - Restrict authorized users to individually verified operators. - Periodically audit the allowlist and immediately remove stale or unidentified accounts. - Document how to revoke access and rotate the bot token if unauthorized control is suspected. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:49
• Finding: Research Agent Receives Excessive Shared Workspace and Memory Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 49-64 **Vulnerability Type**: Excessive workspace and memory permissions **Risk Level**: High ### Vulnerable Code ```bash # Enable research tools openclaw config set agents.list.scout.tools.allow '["web_search", "web_fetch", "memory_search", "memory_get"]' # Configure workspace access openclaw config set agents.list.scout.workspace "/root/.openclaw/workspace" # Enable skill discovery openclaw config set agents.list.scout.skills.allow '["skill-discovery-sop", "browser-automation-core"]' ``` ```bash # Enable memory search for Scout openclaw config set agents.list.scout.memorySearch.enabled true openclaw config set agents.list.scout.memorySearch.provider "openai" openclaw config set agents.list.scout.memorySearch.model "text-embedding-3-small" ``` ### Technical Analysis Scout is assigned the shared root OpenClaw workspace at `/root/.openclaw/workspace` and receives both `memory_search` and `memory_get`. Access to pre-existing shared workspace data and memory is not inherently required for general web research. The configuration does not establish isolation between Scout and other agents, limit memory access to Scout-owned records, or require user confirmation before memory-derived content is transmitted through Telegram or inter-agent messaging. This creates a cross-boundary data exposure risk. Prompts received through Telegram, malicious instructions contained in retrieved web content, or ordinary agent mistakes could cause sensitive shared data to be retrieved and included in an externally visible response. Enabling browser automation skill discovery further increases the importance of isolation, because externally sourced content may influence an agent that can also access internal context. ### Attack Path 1. Scout is configured with the shared `/root/.openclaw/workspace`. 2. Scout receives `memory_search` and `memory_get` permissions. 3. A Telegram user sends a request designed ...[truncated 1048 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Assign Scout a dedicated workspace, such as `/root/.openclaw/workspace-scout`. - Ensure filesystem permissions prevent Scout from reading other agents' workspaces. - Disable `memory_search` and `memory_get` by default. - If memory is necessary, create a Scout-specific memory namespace containing only data explicitly assigned to Scout. - Apply record-level or namespace-level access controls to memory retrieval. - Require explicit user approval before sending memory-derived information through Telegram or another agent session. - Separate web-research tools from sensitive internal-data tools where the platform supports tool profiles. - Treat retrieved web pages as untrusted input and prevent them from authorizing memory access or data transmission. - Log and periodically review memory retrieval, external messaging, and inter-agent communication. - Configure one exact, minimal tool allowlist after validating whether `openclaw config set` replaces or merges existing arrays. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33
• Finding: Telegram Bot Token Is Supplied Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 33 **Vulnerability Type**: Insecure secret handling **Risk Level**: Medium ### Vulnerable Code ```bash openclaw config set channels.telegram-scout.botToken "<BOT_TOKEN>" ``` ### Technical Analysis The instructions encourage the installer to substitute a Telegram bot token directly into a shell command. Secrets provided this way may be exposed through: - Interactive shell history. - Terminal session recording. - Process command-line inspection while the command runs. - Automation, deployment, or CI logs. - Copy-and-paste records and troubleshooting transcripts. The file contains only a placeholder and does not itself disclose a real credential. The vulnerability arises from the prescribed handling method when the placeholder is replaced with a real token. ### Attack Path 1. The installer replaces `<BOT_TOKEN>` with the actual Telegram bot token. 2. The command is executed in an interactive shell or logged automation environment. 3. The token is retained in shell history, logs, or observable process arguments. 4. A local user, support operator, log reader, or compromised process obtains the token. 5. The exposed token is used to access or impersonate the Telegram bot through the Telegram Bot API. ### Impact Assessment A disclosed bot token may allow an attacker to impersonate or operate the bot within the permissions provided by Telegram's Bot API. This can undermine the integrity and confidentiality of the Telegram integration and may facilitate deceptive messages or unauthorized bot activity. The exact impact depends on Telegram's API behavior, existing bot configuration, and whether the token is promptly revoked. This issue does not by itself grant host-level code execution. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not place the token directly in command-line arguments. - Use a protected secret manager or OpenClaw's supported secure credential mechanism. - If supported, read the token from a non-echoing interactive prompt or protected file descriptor. - Restrict secret and configuration files to the service account using permissions such as `0600`. - Disable shell history temporarily only as a secondary safeguard, not as the primary secret-management method. - Prevent deployment systems from echoing secret values into logs. - Document token rotation and emergency revocation procedures. - Rotate the token immediately if it has already appeared in shell history, process telemetry, or logs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Exfiltration Commands

High

• Category: Prompt Injection

Content

## Testing Procedure

1. **Telegram Test**: Send message to @scout_research_bot
2. **Research Test**: Ask "Research solar panel efficiency trends 2026"
3. **Skill Test**: Request "Find skills for data visualization"
4. **Collaboration Test**: Ask to coordinate with Lourens

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill provisions a Telegram bot, requires a bot token, and enables communication with an external third-party platform without any explicit warning about credential handling, data exposure, or trust boundaries. This can lead operators to paste secrets into commands or route potentially sensitive conversations through Telegram without understanding the privacy and security implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables memory search and points it at an external provider (`openai`) while also granting workspace access, but it does not warn that local content may be indexed, embedded, or transmitted off-host. In a research assistant context, this could unintentionally expose sensitive workspace data, notes, or proprietary material to an external service.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and documentation describe Scout as a research assistant with web search, web fetch, memory search, and skill discovery capabilities, and those tools are initially enabled at L048-L055. However, L069 sets the same `agents.list.scout.tools.allow` key to only `["sessions_send"]`, which would replace the earlier research-tool configuration rather than add to it, leaving the agent without the documented research tooling.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file repeatedly specifies that Scout is female and uses she/her pronouns as a fixed requirement. This is a natural-language policy concern because it imposes a language/identity choice without offering customization or user opt-in.

Static analysis

No suspicious patterns detected.