ClawHub

Telegram Topic Rename

Security checks across malware telemetry and agentic risk

Overview

This skill appears to only rename Telegram forum topics as advertised, but users should protect the bot token and confirm the target topic before use.

Install only if you trust it to make real topic-name and icon changes in Telegram chats where your bot has access. Use a dedicated bot with minimal permissions, keep TELEGRAM_BOT_TOKEN out of logs and shared files, and verify the chat_id and thread_id before running the script.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill invokes a shell script (`scripts/rename-topic.sh`) and requires a Telegram bot token, but the manifest does not declare permissions or clearly bound what external actions it can perform. That mismatch can cause the agent or user to authorize a skill without understanding that it can execute shell commands and make live changes to Telegram topics, increasing the risk of unintended or overbroad execution.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The documentation tells operators to provide `TELEGRAM_BOT_TOKEN` but does not clearly warn that this credential will be used to perform authenticated Bot API mutations against Telegram forum topics. This can mislead users about the sensitivity and purpose of the secret, increasing the chance of accidental credential exposure or unintended modifications to chats/topics.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal