ClawHub
Back to skill

Security audit

Telegram Contract Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Telegram contract workflow purpose, but it handles government ID and banking data with unsafe storage, group disclosure, and hardcoded personal data in source code.

Do not deploy this in production until the source and templates are sanitized, Telegram access is restricted to authorized users, sensitive results are returned privately, debug OCR is disabled or admin-only, and all eID/OCR/contract artifacts have documented permissions, cleanup, and retention controls. Treat the hardcoded personal and banking data in the package as exposed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/plan-b-docx-generate.py:50
Finding

Hardcoded Personal Identity and Financial Information

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/telegram-planb-bot.js:13
Finding

Indefinite Plaintext Retention of eID and Contract Data

Content
View full analysis
setTimeout(r, ms)); } function loadState() { try { return JSON.parse(fs.readFileSync(STATE_FILE, 'utf8')); } catch { return { offset: 0, sessions: {} }; } } function saveState(s) { ensureDir(path.dirname(STATE_FILE)); fs.writeFileSync(STATE_FILE, JSON.stringify(s, null, 2)); } ``` Raw OCR data is written to a persistent JSON file: ```javascript async function runSingleOcr(imagePath) { const jsonPath = `${imagePath}.ocr.json`; fs.writeFileSync(jsonPath, execFileSync('swift', ['plan-c-ocr.swift', imagePath], { cwd: WORKSPACE, encoding: 'utf8' })); const data = JSON.parse(fs.readFileSync(jsonPath, 'utf8')); return { data, jsonPath }; } async function runEidOcr(imagePath) { const result = await runSingleOcr(imagePath); const parsed = runJsonCommand('node', ['plan-c-eid-parse.js', result.jsonPath]); return { parsed, rawOcr: result.data, artifacts: [result.jsonPath] }; } ``` The downloaded image path and parsed identity fields are retained in the state file: ```javascript const eidPath = path.join(PLAN_C_TMP_DIR, `${chatId}_${userId}_eid_${Date.now()}.jpg`); await downloadTelegramFile(fileId, eidPath); session.state = 'OCR_PROCESS ...[truncated 3388 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/telegram-planb-bot.js:210
Finding

Group-Wide eID Disclosure Without User-Level Authorization

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/clawhub.md:3
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis
Remediation
View remediation
`. 2. Document the expected package publisher, registry URL, version, and integrity checksum. 3. Verify npm provenance or signed release information before installation. 4. Avoid running global npm installation with `sudo` or an administrator account. 5. Prefer a project-local or isolated installation with a committed lockfile where the operational model permits it. 6. Periodically review the pinned package and its dependency tree before intentional upgrades. 7. Test new versions in an isolated environment before updating production systems. 8. Pin installed Skill versions in production rather than automatically consuming an unreviewed latest release. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (20)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/telegram-planb-bot.js (reported line 7)May include surrounding context.

js
#!/usr/bin/env node

const fs = require('fs');
const path = require('path');
const { execFileSync } = require('child_process');

const TOKEN = process.env.TELEGRAM_BOT_TOKEN || '';
const API = TOKEN ? `https://api.telegram.org/bot${TOKEN}` : '';
const POLL_MS = Number(process.env.TELEGRAM_POLL_INTERVAL_MS || 3000);
const WORKSPACE = process.cwd();
const OUTPUT_DIR = process.env.PLAN_B_OUTPUT_DIR || path.join(WORKSPACE, 'plan-b', 'output');
const TEMPLATE_DOCX = process.env.PLAN_B_TEMPLATE_DOCX || path.join(WORKSPACE, 'plan-b', 'originals', 'talent_individual_original.docx');
const STATE_FILE = path.join(WORKSPACE, '.state', 'telegram-planb-bot.json');
const MANAGEMENT_CHAT_ID = String(process.env.TELEGRAM_MANAGEMENT_CHAT_ID || '');
c

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/telegram-planb-bot.js (reported line 92)May include surrounding context.

js
}

function clearSession(state, chatId, userId) {
  if (state.sessions) delete state.sessions[sessionKey(chatId, userId)];
}

function isPhotoMessage(msg) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly processes Vietnamese electronic ID screenshots, performs OCR on identity fields, and converts them into contract-ready inputs, but it provides no privacy, retention, consent, masking, or access-control guidance. Because this workflow handles highly sensitive personal data (government ID numbers, birth dates, addresses), omission of data-handling safeguards materially increases the risk of unauthorized exposure, over-collection, insecure storage, and accidental sharing in Telegram chats or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The deployment guide instructs operators to place a Telegram bot token and real chat IDs into local environment files but does not warn about secure storage, file permissions, accidental commits, shell history, or log exposure. Because a Telegram bot token grants direct control over the bot and chat IDs reveal internal routing targets, weak handling can lead to bot takeover, message interception, spam, or unauthorized workflow execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide tells users to send electronic ID/CCCD screenshots through Telegram for OCR testing without any privacy, consent, retention, or data-handling warning. Government ID images contain highly sensitive personal data, and transmitting them through chat workflows and OCR pipelines increases the risk of unauthorized disclosure, retention in chat history, or secondary processing beyond the user's expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template enforces a specific language/locale for all input fields such as TEN, NGAY_SINH, and THUONG_TRU, and the file does not provide any opt-in, alternative language, or justification for this restriction. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown content is written in Vietnamese, including operational notes and section headings, with no indication that users may choose another language or that the skill is intentionally limited to Vietnamese-speaking users. This can violate language/locale policy when a skill imposes a specific language without opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains the operational guidance almost entirely in Vietnamese, which effectively forces a specific language for users of the skill. The file does not provide an opt-in, translation alternative, or justification that the skill is intended only for a Vietnamese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file defines required keys and default contract text entirely in Vietnamese, and generated values such as contract title and location are fixed to a Vietnamese locale. There is no natural-language indication that the locale is optional, user-selectable, or restricted to a justified region-specific deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script processes highly sensitive personal and financial data including ID number, date of birth, address, phone, email, and bank account, then writes the full mapped payload to disk as a JSON file. Persisting this data in plaintext creates unnecessary exposure through local compromise, backups, shared workstations, logs, or later accidental disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

With no manifest available, the only evident purpose from the file is transforming structured input into contract data and producing a DOCX. Spawning an external process via python3 adds a broader execution capability than is justified by any stated purpose in the provided context, because the file documentation does not declare that it delegates work to another executable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script reads OCR output from an identity document and prints the full extracted result to stdout, including highly sensitive personal data such as full name, date of birth, national ID number, addresses, and even the original OCR text. In many agent, CI, or orchestration environments, stdout is captured in logs, terminals, or monitoring systems, which can unintentionally disclose regulated personal data to unauthorized parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script hard-codes recognitionLanguages to ["vi-VN", "en-US"], which imposes specific locale handling on all inputs. Under the policy, language or locale restrictions should either be user-selectable or clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/telegram-planb-bot.js (reported line 8)May include surrounding context.

js
const { execFileSync } = require('child_process');

const TOKEN = process.env.TELEGRAM_BOT_TOKEN || '';
const API = TOKEN ? `https://api.telegram.org/bot${TOKEN}` : '';
const POLL_MS = Number(process.env.TELEGRAM_POLL_INTERVAL_MS || 3000);
const WORKSPACE = process.cwd();
const OUTPUT_DIR = process.env.PLAN_B_OUTPUT_DIR || path.join(WORKSPACE, 'plan-b', 'output');

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/telegram-planb-bot.js (reported line 60)May include surrounding context.

js
const { execFileSync } = require('child_process');

const TOKEN = process.env.TELEGRAM_BOT_TOKEN || '';
const API = TOKEN ? `https://api.telegram.org/bot${TOKEN}` : '';
const POLL_MS = Number(process.env.TELEGRAM_POLL_INTERVAL_MS || 3000);
const WORKSPACE = process.cwd();
const OUTPUT_DIR = process.env.PLAN_B_OUTPUT_DIR || path.join(WORKSPACE, 'plan-b', 'output');

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

OCR output is written to a JSON artifact on disk, which can contain extracted ID numbers, names, birth dates, and other personal data. Persisting these artifacts locally without notice or retention controls creates a meaningful confidentiality risk, especially because this bot is specifically designed to process government ID data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The bot downloads CCCD ID images to local disk and stores session state around them without informing users about retention or handling. Because this workflow processes highly sensitive identity data, undisclosed local persistence increases the risk of privacy breaches, unauthorized reuse, and forensic recovery from the host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The /start response says the management chat is mapped to 'Plan A (management/employee reminders)' and later says the group is used to receive 'management/employee' reports. However, the management branch contains no reminder or reporting logic beyond returning informational text. This is an active intent mismatch in user-facing inline documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script invokes python3 plan-b-docx-generate.py generate ... to perform document generation, but the file contains no prompt, warning, or explanatory comment telling the user that it will execute another local program. For a code-file audit, subprocess execution is safety-relevant when not disclosed anywhere in the script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The script reads TELEGRAM_BOT_TOKEN from the environment to authenticate with Telegram, but there is no inline explanation or user-facing documentation in this file about its use. Under this rule, access to credentials should include some disclosure unless it is already clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/telegram-planb-bot.js:75

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/telegram-planb-bot.js:7