ClawHub
Back to skill

Security audit

Telegram Compose

Security checks for vulnerabilities and agentic risk

Overview

This skill sends Telegram messages as advertised, but it needs Review because it can automatically transmit content using a local bot token and may expose messages or credentials through weak routing and token handling.

Install only if you are comfortable with this skill automatically sending Telegram-targeted substantive messages through a bot token stored in OpenClaw config. Keep the bot limited to intended chats, avoid sending secrets or sensitive reports through it, and treat invalid topic fallback and command-line token exposure as issues to fix before high-sensitivity use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:109
Finding

Telegram Bot Token Exposed in Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation
/`. - Keep token variables scoped to the shortest possible execution period and unset them after the request. - Rotate the bot token if command arguments may already have been captured in logs or process telemetry. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:292
Finding

Failed Topic Delivery Is Silently Redirected to the General Topic

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is configured to be auto-invoked for broad categories like any Telegram reply over 3 lines or containing structured data. That can cause the skill to trigger in many normal workflows and forward content externally without a narrowly scoped user intent check, increasing the chance of unintended data disclosure to Telegram.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The spawning rule is permissive and operationally ambiguous: 'substantive content' and '>3 lines' are weak criteria for a network-sending skill. In context, this ambiguity matters because the skill reads credentials and transmits data to an external API, so loose dispatch logic can lead to accidental exfiltration of sensitive content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The explicit use of the Telegram API endpoint confirms outbound data leaves the local trust boundary. In a skill that can be triggered automatically and instructed by caller-supplied chat IDs, this increases the risk of unauthorized disclosure, misdelivery, or abuse for covert exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
BOT_TOKEN=$(jq -r ".channels.telegram.accounts.$ACCOUNT.botToken" "$CONFIG")

# Without topic thread
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg chat "$CHAT_ID" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The explicit use of the Telegram API endpoint confirms outbound data leaves the local trust boundary. In a skill that can be triggered automatically and instructed by caller-supplied chat IDs, this increases the risk of unauthorized disclosure, misdelivery, or abuse for covert exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
BOT_TOKEN=$(jq -r ".channels.telegram.accounts.$ACCOUNT.botToken" "$CONFIG")

# Without topic thread
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg chat "$CHAT_ID" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The threaded-message variant sends the same content externally, with an additional caller-controlled thread target. This broadens the chance of misrouting sensitive information into the wrong Telegram topic while still exposing data to an external service using local credentials.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
}')"

# With topic thread
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg chat "$CHAT_ID" \

Static analysis

No suspicious patterns detected.