ClawHub
Back to skill

Security audit

Tg Message Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Telegram briefing purpose, but its setup guidance enables broad Telegram, browser, email, and scheduling powers that deserve review before installation.

Install only if you are comfortable granting the agent access to Telegram content, Gmail or browser sessions, and optional scheduled sending. Prefer a dedicated low-privilege Telegram/email account, pin and review MCP or ClawHub dependencies before enabling them, restrict recipients and source channels, and require an explicit final approval before any message, email, or recurring task is created.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
adapters/codex/SKILL.md:83
Finding

Unpinned MCP Packages Are Downloaded and Executed with Sensitive Account Access

Content
View full analysis

Vulnerability Details

File Location: adapters/codex/SKILL.md:83-87 and adapters/codex/SKILL.md:106-111
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

toml
[mcp_servers.telegram]
command = "npx"
args = ["-y", "mcp-telegram"]
env = { TELEGRAM_API_ID = "your_api_id", TELEGRAM_API_HASH = "your_api_hash" }
enabled = true
toml
[mcp_servers.email]
command = "npx"
args = ["-y", "@kembec/email-mcp"]
enabled = true

Technical Analysis

The recommended configurations use npx -y to retrieve and execute mutable packages without specifying a reviewed version or integrity hash. The -y option suppresses the normal installation prompt, while the absence of a version allows the package registry's current release to determine which code runs.

These dependencies operate in sensitive trust contexts. The Telegram MCP server receives Telegram API credentials and connects through a real Telegram user account. The email MCP server can receive OAuth authorization for an email account. Consequently, compromise of the package, its publisher, its transitive dependencies, or the registry delivery path could place attacker-controlled code inside an authenticated agent process.

Attack Path

  1. The user chooses the MCP-based integration strategy.
  2. The agent or user adds the documented MCP configuration to ~/.codex/config.toml.
  3. A package publisher account, package release, transitive dependency, or registry distribution path is compromised.
  4. A later MCP invocation runs npx -y and downloads the current compromised release.
  5. The package executes locally with access to the environment and the authorization supplied to the MCP server.
  6. Malicious code can capture Telegram credentials, misuse an authenticated account, inspect accessible messages, or abuse email authorization.

Impact Assessment

A compromised Telegram depen ...[truncated 622 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every package to a specifically reviewed version, such as mcp-telegram@x.y.z and @kembec/email-mcp@x.y.z.
  2. Use a lockfile or equivalent integrity mechanism that verifies package hashes and transitive dependencies.
  3. Verify package publisher identity, source repository provenance, release signatures, and maintenance history before recommending installation.
  4. Remove automatic -y execution where practical so installation remains an explicit user-approved operation.
  5. Install dependencies in an isolated environment with restricted filesystem, environment-variable, and network access.
  6. Do not expose credentials to the general agent environment. Pass them only to the reviewed integration process through an appropriate secret manager.
  7. Establish an update-review process rather than automatically consuming the latest package release.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
adapters/codex/SKILL.md:91
Finding

Recommended Integrations Expose Capabilities Beyond Briefing Generation Requirements

Content
View full analysis

Vulnerability Details

File Location: adapters/codex/SKILL.md:91-92 and adapters/openclaw/SKILL.md:98-105
Vulnerability Type: Excessive Telegram and email integration privileges
Risk Level: Medium

Vulnerable Code

markdown
`mcp-telegram` (`beautyfree/mcp-telegram`) provides 102+ tools: read/search/send messages,
manage channels, transcribe voice, and more via MTProto (real Telegram user account).
markdown
### Gmail (AgentMail)

```bash
clawhub install agentmail

AgentMail provides send, read, reply, search, and organize capabilities. First use will trigger OAuth — guide the user through browser authorization.

text

### Technical Analysis

The declared workflow requires reading selected Telegram channel messages and sending a reviewed briefing through Telegram or Gmail. The recommended integrations expose broader capabilities:

- Telegram channel management and numerous additional MTProto operations.
- Email reading, replying, searching, and organizing, although the workflow only requires sending a briefing.

This violates least-privilege design by making unrelated account operations available to the agent. Broad tool exposure increases the consequences of agent mistakes, malicious instructions embedded in retrieved channel content, or compromise of an integration dependency.

The central workflow does provide an important protection: `core/prompt.md:69-91` requires the generated briefing to be shown to the user before delivery. However, that review requirement does not technically restrict unrelated tools made available by the integrations.

### Attack Path

1. The user configures `mcp-telegram` or authorizes AgentMail to perform the legitimate briefing task.
2. The integration exposes channel-management or broad mailbox operations to the agent.
3. Untrusted Telegram content contains adversarial instructions, the agent makes an erroneous tool selection, or the integration it
...[truncated 875 chars]
Remediation
View remediation

Remediation Suggestions

  1. Expose only the Telegram operations required to read selected channels and send to explicitly approved recipients.
  2. Disable channel-management, contact-management, transcription, deletion, and other unrelated Telegram tools.
  3. Use an email integration that supports send-only authorization where available.
  4. Request the minimum OAuth scopes and document them before authorization.
  5. Apply explicit allowlists for source channels and delivery recipients.
  6. Require user confirmation immediately before every send or state-changing operation, including scheduled-job creation.
  7. Treat retrieved Telegram messages as untrusted data and explicitly prohibit following instructions contained within them.
  8. Use a dedicated low-privilege service account or bot instead of a personal Telegram or email account where feasible.
  9. Add runtime policy enforcement so the tool layer, rather than only textual instructions, blocks unrelated operations.

T08 · Insecure Dependencies

Warning
Location
adapters/openclaw/SKILL.md:47
Finding

Unpinned ClawHub Skills Are Installed into Authenticated Browser and Email Workflows

Content
View full analysis

Vulnerability Details

File Location: adapters/openclaw/SKILL.md:47-50 and adapters/openclaw/SKILL.md:98-105
Vulnerability Type: Unverified and unpinned third-party Skill installation
Risk Level: Medium

Vulnerable Code

markdown
Install the Playwright Scraper skill if not already available:
```bash
clawhub install playwright-scraper
text

```markdown
### Gmail (AgentMail)

```bash
clawhub install agentmail

AgentMail provides send, read, reply, search, and organize capabilities. First use will trigger OAuth — guide the user through browser authorization.

text

### Technical Analysis

The OpenClaw adapter recommends installing named ClawHub skills without a version, checksum, signature requirement, publisher verification procedure, or review step. The resulting dependency is mutable after this Skill has been audited.

The installed skills operate in particularly sensitive contexts. A browser automation skill may interact with active Telegram and Gmail sessions, while AgentMail receives email OAuth authorization. If either downloaded skill or its dependency chain is compromised, attacker-controlled behavior could execute with access to authenticated services.

### Attack Path

1. The user chooses the browser-automation or AgentMail strategy.
2. The agent follows the documented `clawhub install` command.
3. The current registry release is malicious, has been compromised, or has changed since the parent Skill was reviewed.
4. OpenClaw installs and loads the mutable third-party Skill.
5. The installed Skill receives browser access to authenticated Telegram/Gmail sessions or email OAuth authorization.
6. Malicious instructions or code access session-visible data, send unauthorized communications, or misuse granted mailbox capabilities.

### Impact Assessment

A compromised browser automation Skill could interact with any authenticated service available in the controlled browser
...[truncated 435 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each ClawHub dependency to a reviewed immutable version or content digest.
  2. Verify publisher identity, repository provenance, signatures, and release integrity before installation.
  3. Display the exact dependency version and requested permissions to the user before installing it.
  4. Review downloaded Skill instructions and executable content before enabling the Skill.
  5. Run browser automation in a dedicated browser profile containing only the accounts required for the briefing workflow.
  6. Restrict browser navigation to explicit Telegram and Gmail origins and block arbitrary external destinations.
  7. Prefer platform-native, narrowly scoped APIs over general browser control or broad mailbox integrations.
  8. Apply send-only or otherwise minimal OAuth scopes to email integrations.
  9. Require explicit confirmation before external transmission, preserving the preview requirement in core/prompt.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Instructing use of the agent’s config path (~/.codex/config.toml) encourages interaction with sensitive local configuration and credentials. In the context of a skill, this expands access toward secrets and persistent agent configuration, which can expose API tokens or alter trusted runtime behavior beyond the briefing task.

Content

Scanner excerpt · adapters/codex/SKILL.md (reported line 41)May include surrounding context.

md
|------|------|
| Fast, reliable API access | Requires `TELEGRAM_API_ID` + `TELEGRAM_API_HASH` |
| 102+ Telegram tools via `mcp-telegram` | Requires OAuth setup for Gmail |
| Better for large channels and recurring tasks | MCP config in `~/.codex/config.toml` |

---

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
93% confidence
Finding

The explicit instruction to add MCP server settings to ~/.codex/config.toml creates a pathway to sensitive configuration access and persistent environment changes. This is dangerous because it can expose or normalize handling of secrets such as Telegram API credentials and may encourage an agent to manipulate trusted local configuration outside the user’s immediate intent.

Content

Scanner excerpt · adapters/codex/SKILL.md (reported line 81)May include surrounding context.

Telegram MCP (mcp-telegram)

Add to ~/.codex/config.toml:

toml
[mcp_servers.telegram]

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The native setup directs installation of a general-purpose email skill that supports send, read, reply, search, and organize functions, even though the skill is presented as a Telegram briefing tool. This is a meaningful scope expansion because it introduces mailbox access and modification capabilities unrelated to the minimum functionality needed for generating Telegram briefings.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Mailbox read/search/reply/organize capabilities are unnecessary for a Telegram summarization workflow and grant the agent access to sensitive email content and account-manipulation functions. If misused, this could expose private correspondence, enable unauthorized replies, or alter mailbox state far beyond the user's expected task.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/multi-platform-research.md (reported line 149)May include surrounding context.

推荐使用 mcp-telegram：它是目前最完整的 MCP 方案，直接连接用户真实 Telegram 账号（非 Bot），工具覆盖全面。

Codex CLI 配置 (~/.codex/config.toml):

toml
[mcp_servers.telegram]
command = "npx"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/multi-platform-research.md (reported line 168)May include surrounding context.

推荐使用 mcp-telegram：它是目前最完整的 MCP 方案，直接连接用户真实 Telegram 账号（非 Bot），工具覆盖全面。

Codex CLI 配置 (~/.codex/config.toml):

toml
[mcp_servers.telegram]
command = "npx"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/multi-platform-research.md (reported line 238)May include surrounding context.

推荐使用 mcp-telegram：它是目前最完整的 MCP 方案，直接连接用户真实 Telegram 账号（非 Bot），工具覆盖全面。

Codex CLI 配置 (~/.codex/config.toml):

toml
[mcp_servers.telegram]
command = "npx"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/multi-platform-research.md (reported line 266)May include surrounding context.

推荐使用 mcp-telegram：它是目前最完整的 MCP 方案，直接连接用户真实 Telegram 账号（非 Bot），工具覆盖全面。

Codex CLI 配置 (~/.codex/config.toml):

toml
[mcp_servers.telegram]
command = "npx"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises very broad trigger phrases like "generate report," "send briefing," and "message summary," which can match many ordinary user requests unrelated to Telegram channel summarization. Overbroad activation increases the chance the skill is invoked in the wrong context, causing unintended access to Telegram/Gmail tooling and expanding the opportunity for data exposure or unintended outbound messaging.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad and overlap with ordinary requests like 'generate report' or 'send briefing,' increasing the chance this skill is invoked in contexts the user did not intend. Because the skill can access Telegram/Gmail and perform outbound actions, overbroad activation raises the risk of unnecessary data access and unintended sends.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill’s declared purpose is generating Telegram briefings, but the documented behavior includes sending messages through Telegram and Gmail. This expands the effective capability from summarization into outbound communication, which can surprise users and create opportunities for unintended data disclosure or unauthorized message delivery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions direct the agent to send Telegram messages and Gmail emails but do not require a prominent user warning or a final confirmation before outbound delivery. In a skill with browser automation and access to logged-in sessions, this can cause accidental exfiltration of summarized content to external recipients or channels.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Referencing a Telegram MCP with '102+ tools' including account and channel management materially exceeds the stated briefing/summarization scope. Even if not directly invoked here, documenting broad control encourages over-privileged integration and increases the chance that an agent will use powerful account-management actions unrelated to the user’s intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description says to use this skill when the user mentions phrases like "briefing," "generate report," or "send briefing," which are generic and could match many unrelated tasks outside Telegram-channel summarization. The trigger guidance does not include limiting conditions or negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes instructions to send Telegram messages and emails on the user's behalf without requiring an explicit warning or confirmation about outbound actions and data disclosure. This increases the risk of accidental exfiltration, unintended recipient targeting, or unauthorized communication using an already-authenticated browser session.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is scoped as a Telegram briefing assistant, but it instructs the agent to use Gmail Web for outbound email delivery. That expands the effective authority of the skill beyond its declared purpose, increasing the chance that users or downstream systems invoke email-sending behavior they did not explicitly authorize or expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation description uses very broad trigger phrases like "generate report" and "send briefing," which can match many ordinary user requests unrelated to Telegram summarization. In an agentic environment, this can cause the skill to activate unexpectedly and pull, summarize, or transmit Telegram content in contexts where the user did not intend to use this capability, increasing the risk of unintended data access or delivery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly supports delivering compiled Telegram channel content to Telegram recipients and Gmail, but it does not present any privacy warning or consent checkpoint about forwarding potentially sensitive or copyrighted content to third parties. This is dangerous because users may inadvertently redistribute private, restricted, or sensitive information across external channels, especially with scheduled automation that can repeat the exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The document recommends launching an MCP server via npx -y mcp-telegram without pinning a specific package version. This creates a supply-chain risk because future package updates or a compromised upstream release could silently change the code executed by users, and in this context the package is granted access to a real Telegram account, increasing the consequence of compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This section encourages use of integrations that directly access a user's real Telegram account and email-sending capabilities, but it does not explicitly warn about privacy exposure, message exfiltration, impersonation, or account-impact risks. In a skill focused on aggregating and forwarding Telegram content, omission of these warnings increases the chance that users will authorize powerful integrations without understanding the sensitivity of the data and actions involved.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The document recommends npx -y @kembec/email-mcp without version pinning, which can cause users to execute whatever the latest published package is at runtime. Because this MCP server is intended to handle email access and sending, an upstream compromise or breaking change could expose mailbox contents or abuse outbound email capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest mentions 'scheduled push' as a use case, but the file goes further by directing use of CodexClaw cron or system cron with codex exec. That adds host-level task scheduling capability, which is materially broader than merely generating and sending briefings and is not explicitly declared in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.