ClawHub
Back to skill

Security audit

Tg Bot Builder Free

Security checks for vulnerabilities and agentic risk

Overview

This Telegram bot-building skill is not clearly malicious, but it asks for broad agent authority and gives under-scoped guidance around bot tokens and group-message access.

Review before installing. Use this only for Telegram bot projects, avoid broad auto-invocation, store bot tokens in protected secrets, rotate any token pasted into shell history or logs, pin dependencies for real deployments, and disable Telegram group privacy mode only with administrator approval and clear notice to group members.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:119
Finding

Telegram Bot Token May Be Exposed Through Command-Line Arguments and Shell History

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 119
Vulnerability Type: Credential exposure through command-line URL
Risk Level: Medium

Vulnerable code:

bash
# Set the webhook (replace TOKEN and the domain)
curl -s "https://api.telegram.org/bot<TOKEN>/setWebhook?url=https://yourdomain.com/webhook"

Technical Analysis

The documented command instructs the user to replace the token placeholder directly inside a command-line URL. After substitution, the Telegram bot token can be exposed through shell history, terminal transcripts, process inspection, command auditing, or CI/CD logs.

Although the document separately recommends storing the token in the TELEGRAM_BOT_TOKEN environment variable, this command does not follow that guidance. Telegram Bot API URLs inherently contain the token in the request path, so operational controls are also required to prevent the expanded URL from being logged.

Attack Path

  1. A user replaces <TOKEN> with a valid Telegram bot token.
  2. The user runs the resulting command in an interactive shell, automation system, or shared environment.
  3. The expanded command is retained in shell history, process telemetry, terminal output, or job logs.
  4. An attacker with access to those records retrieves the token.
  5. The attacker uses the token to make authenticated Telegram Bot API requests.
  6. The attacker performs actions available to the compromised bot until the token is revoked.

Impact Assessment

A recovered token can allow an attacker to impersonate and operate the affected bot through the Telegram Bot API. Depending on the bot's role and permissions, this may permit sending or modifying messages, changing webhook configuration, receiving future updates through an attacker-controlled webhook, and interacting with chats or groups accessible to the bot.

This does not directly grant host-level privileges. The scope is limited to the com ...[truncated 131 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not instruct users to paste a bot token into an interactive command.
  • Read the token from a protected environment variable and prevent command tracing or verbose logging while executing the request.
  • Avoid printing the expanded Telegram API URL in terminal output, CI/CD logs, exception messages, or diagnostics.
  • Run the command only in an environment where process and environment inspection is restricted to the owning account.
  • Configure shell-history exclusion where appropriate and ensure automation systems mask the token.
  • Store the token in a dedicated secret manager for production deployments rather than a plaintext .env file.
  • Rotate the bot token through BotFather immediately if it has appeared in history, logs, screenshots, or shared terminal output.
  • Document that, because Telegram places the token in the API path, reverse proxies and HTTP clients must redact request paths containing bot tokens.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:240
Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 240–242
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable code:

text
| python-telegram-bot | Python library | Recommended | `pip install python-telegram-bot` |
| telegraf | Node.js library | Optional | `npm install telegraf` |
| requests | Python library | Optional | `pip install requests` |

Technical Analysis

The installation instructions do not pin dependency versions, use lockfiles, or verify package integrity. As a result, separate installations can resolve to different package versions, and users automatically trust whichever release the configured package registry serves at installation time.

The package names shown are conventional and the audited file does not identify a malicious package or unsafe third-party registry. The vulnerability is therefore the absence of reproducible and integrity-controlled dependency resolution, not evidence that the listed packages are currently malicious.

A compromised upstream release, registry account, dependency chain, or package distribution channel could introduce attacker-controlled code. Package code may run during installation or later when imported and used by the generated bot.

Attack Path

  1. An attacker compromises an upstream maintainer account, package registry, release pipeline, or transitive dependency.
  2. The attacker publishes a malicious or backdoored release under a dependency version accepted by the unpinned command.
  3. A user follows the documented pip install or npm install instruction.
  4. The package manager resolves and downloads the compromised release because no reviewed version or integrity hash is required.
  5. Malicious code executes during installation, package initialization, import, or bot runtime.
  6. The code operates with the privileges and access of the account running the installation or bot.

Impact Assessment

...[truncated 605 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace unconstrained installation commands with reviewed, exact dependency versions.
  • Maintain committed lockfiles, such as a hash-locked Python requirements file and package-lock.json for npm.
  • For Python, use hash verification such as pip install --require-hashes -r requirements.txt.
  • For Node.js, commit the lockfile and use npm ci in automated and production environments.
  • Review transitive dependencies and run ecosystem-appropriate vulnerability audits before deployment.
  • Upgrade dependencies through a controlled review process rather than automatically accepting the newest release.
  • Use trusted registries and explicitly configure approved package sources where organizational policy requires them.
  • Install and run the bot under a dedicated, non-administrative account with access only to required files and secrets.
  • Build dependencies in an isolated environment and promote reviewed artifacts into production.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises activation for very broad tasks such as code generation, debugging, testing, and deployment without clear constraints, which can cause the agent to invoke it in contexts beyond Telegram bot building. Overbroad routing increases the chance of unintended tool use, cross-context data exposure, or generation/execution of actions the user did not specifically mean to delegate to this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The capability coverage section defines activation through an extremely broad keyword list, including fragmented and generic terms, making accidental invocation highly likely. In agent systems, this kind of overmatching can route unrelated user requests into a skill with write/exec capabilities, increasing the risk of unintended actions or misuse of available tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

bash
# 设置Webhook（替换TOKEN和你的域名）
curl -s "https://api.telegram.org/bot<TOKEN>/setWebhook?url=https://yourdomain.com/webhook"

示例

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest and FAQ state that the free edition does not support '批量消息推送' and frames that as a professional-only capability, yet the '最佳实践' section provides an implementation pattern for queued outbound sending at scale. That documentation materially contradicts the stated feature boundary for the free version rather than merely omitting details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance recommends disabling BotFather privacy mode so the bot can read all group messages, but it does so without a clear privacy warning, consent requirement, or data-minimization guidance. This can normalize broad collection of group communications and lead developers to deploy bots that monitor messages more extensively than users expect.

Content

No source excerpt is available for this finding.