Telegram Send File

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:06 PM UTC
• Version: 0.1.0

Overview

This skill does what it advertises, but it can upload arbitrary local files to Telegram using auto-discovered bot credentials and chat context without an explicit confirmation step.

Install only if you are comfortable with an agent-accessible command that can send any readable file to Telegram. Prefer explicit --chat-id/--topic-id, verify the file path before use, store the bot token with restrictive permissions or an environment secret manager, avoid passing tokens on the command line, and pin dependencies in your own environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:25
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:25-31`; `scripts/telegram_send_file.py:27-29` **Vulnerability Type**: Unpinned third-party dependency / software supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `README.md:25-31`: ```bash pip install python-telegram-bot>=20.0 ``` `scripts/telegram_send_file.py:27-29`: ```python except ImportError: print("Error: python-telegram-bot not installed. Run: pip install python-telegram-bot>=20.0") sys.exit(1) ``` ### Technical Analysis The project instructs users to install any release of `python-telegram-bot` satisfying `>=20.0`. It does not provide an exact version, lock file, or package integrity hashes. Consequently, the code installed by a user can differ from the dependency version that was originally reviewed. The dependency executes in the same Python process as the skill and therefore has access to the bot token, destination chat information, local files selected for upload, environment variables, and the invoking user's filesystem permissions. If a future eligible release or its distribution channel is compromised, malicious package code could execute during installation or import. This finding does not establish that the current `python-telegram-bot` package is malicious. The vulnerability is the absence of reproducible dependency pinning and integrity verification. ### Attack Path 1. An attacker compromises a future release, maintainer account, or distribution artifact for the dependency. 2. The compromised release still satisfies the documented `>=20.0` version constraint. 3. A user follows the installation instruction or updates the package at a later date. 4. The package manager downloads and installs the compromised release. 5. Malicious installation or import-time code executes with the privileges of the invoking user. 6. The malicious code can access Telegram credentials, selected files, and other data available to the process. ### Impact Assessment S ...[truncated 484 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version rather than using an open-ended lower bound: ```text python-telegram-bot==<reviewed-version> ``` 2. Add a committed lock or requirements file containing cryptographic hashes. 3. Install with hash verification, such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Regularly review and deliberately update the pinned version after security testing. 5. Document installation from an approved package index and discourage untrusted mirrors. 6. Avoid installing dependencies with administrator or root privileges. 7. Update both the README and the import-error message so they reference the secured, reproducible installation process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/telegram_send_file.py:240
• Finding: Telegram Bot Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telegram_send_file.py:240`; `scripts/telegram_send_file.py:263` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/telegram_send_file.py:240`: ```python parser.add_argument("--token", help="Override bot token") ``` `scripts/telegram_send_file.py:263`: ```python token = args.token or get_token() ``` ### Technical Analysis The `--token` option permits a Telegram bot token to be supplied directly on the command line. Command-line arguments are not an appropriate secret-transport mechanism because they can be retained in shell history, terminal logs, automation logs, diagnostic output, or process-monitoring systems. Depending on the operating system and process isolation configuration, another local user or monitoring agent may also be able to inspect the command line while the process is running. Although the script does not intentionally log the token, accepting it as an argument exposes it outside the script's direct control. ### Attack Path 1. A user runs the utility with a command such as: ```bash python3 scripts/telegram_send_file.py --token "BOT_TOKEN" --file document.pdf ``` 2. The complete command is recorded in shell history, an automation log, or process metadata. 3. Another local user, administrator, compromised monitoring component, or attacker with access to that record retrieves the token. 4. The attacker submits Bot API requests using the stolen credential. 5. The attacker operates as the bot within the chats and permissions already granted to it. ### Impact Assessment A disclosed token allows impersonation of the Telegram bot. The attacker may be able to send files or messages, retrieve bot-accessible updates, disrupt expected bot behavior, or interact with chats according to the bot's granted permissions. The token does not inherently grant operating-system access, and ...[truncated 86 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--token` command-line option. 2. Continue supporting the `TELEGRAM_BOT_TOKEN` environment variable where appropriate, while documenting that environment access should also be restricted. 3. Prefer a permission-restricted configuration file or operating-system credential store. 4. If interactive entry is required, use a hidden prompt: ```python import getpass token = getpass.getpass("Telegram bot token: ") ``` 5. Ensure error and verbose logging never includes the token or Bot API URLs containing it. 6. Advise users who previously supplied tokens on the command line to clear affected history and logs and rotate exposed tokens through BotFather. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:46
• Finding: Recommended Token File Creation Does Not Enforce Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `README.md:46-49` **Vulnerability Type**: Insecure plaintext credential file permissions **Risk Level**: Low ### Vulnerable Code ```bash # Option A: config file (recommended) echo "YOUR_TOKEN" > ~/.telegram_bot_token ``` ### Technical Analysis The recommended command stores the Telegram bot token in plaintext without explicitly setting owner-only permissions. The resulting permissions depend on the user's active `umask`. On a shared system with a permissive `umask`, the token file may be readable by other local accounts. The script subsequently reads this file as a credential source. It does not inspect the file owner or reject group-readable or world-readable permissions before using the token. ### Attack Path 1. A user follows the documented command while operating under a permissive `umask`. 2. `~/.telegram_bot_token` is created with permissions that allow an unintended local account to read it. 3. Another local user or a process running under that account reads the plaintext token. 4. The attacker uses the token to authenticate directly to the Telegram Bot API. 5. The attacker impersonates the bot within its existing Telegram permissions. ### Impact Assessment Successful exploitation exposes the Telegram bot credential to another local principal. The attacker can perform Bot API operations available to that bot, including unauthorized messaging or file delivery to accessible chats. This issue does not directly provide operating-system privilege escalation; its scope is primarily the bot account and its Telegram permissions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the documented creation procedure with one that enforces owner-only access: ```bash umask 077 printf '%s\n' "YOUR_TOKEN" > ~/.telegram_bot_token chmod 600 ~/.telegram_bot_token ``` 2. Recommend an operating-system credential store instead of a plaintext file where available. 3. In the script, inspect the token file's owner and permission bits before reading it. 4. Reject or prominently warn about token files that are group-readable, world-readable, or owned by another user. 5. Apply the same permission checks to all supported plaintext token locations. 6. Document token rotation through BotFather if a token file was previously exposed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README promotes sending local files to Telegram and auto-detecting Telegram/OpenClaw chat context, but it does not warn users that this can transmit sensitive local data to an external service or to an unintended chat/thread. In a skill meant for agent use, auto-detection lowers friction for exfiltration or accidental disclosure because the operator may not explicitly verify the destination before sending.

External Transmission

Medium

• Category: Data Exfiltration

Content

Send any message to your bot in Telegram, then visit:

```
https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates
```

Look for `"id": 5866004662` in the JSON response — that's your personal chat ID.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents execution of a local Python script that can read local files and likely access environment-derived Telegram/session context, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens security review and policy enforcement, because consumers of the skill may not realize it needs file-read and environment access before using it to transmit data to an external Telegram chat.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script silently sources a Telegram bot token from environment variables and multiple local files, including OpenClaw state/config, without requiring explicit user acknowledgement at send time. In an agent skill context, this lowers the barrier to unauthorized message/file transmission if the skill is invoked unexpectedly or by a compromised workflow, because credentials are auto-discovered and immediately usable.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill can transmit arbitrary local files, URLs, or Telegram file_ids to an external Telegram chat with no confirmation prompt, while also auto-detecting chat/thread context from environment or OpenClaw session state. In an agent environment, that creates a clear exfiltration primitive: if the tool is called on sensitive paths or attacker-influenced inputs, data can leave the host immediately to a remote destination.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This markdown file contains multiple examples for sending documents, photos, videos, audio, and voice messages to Telegram, which inherently transmit user-provided file data over the network. The reference does not include any warning about privacy, external transmission, or verifying that the files are safe and intended to be shared.

Static analysis

No suspicious patterns detected.