ClawHub
Back to skill

Security audit

Tg Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is not proven harmful, but it should be reviewed because it uses an existing Telegram login through an external host program that is not included or pinned in the package.

Install only in an environment where /usr/local/bin/tg_search is independently audited, owned by a trusted administrator, not writable by the skill runtime, and where the Telethon session is dedicated to this public-search use. Add or require limit validation, execution timeouts, and provenance checks before treating this as low-risk.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
run.py:10
Finding

Documented Search Result Limit Is Not Enforced

Content
View full analysis

Vulnerability Details

File Location: run.py:10-14
Vulnerability Type: Missing input validation and resource-bound enforcement
Risk Level: Medium

Vulnerable Code

python
query = sys.argv[1]
limit = sys.argv[2] if len(sys.argv) >= 3 else "10"

p = subprocess.run(
    ["/usr/local/bin/tg_search", query, limit],

SKILL.md:11-13 documents the intended constraint:

markdown
## Inputs
- query (string, required): e.g. "crypto", "здоровье", "ai agents"
- limit (int, optional, default 10, max 50)

Technical Analysis

The wrapper forwards the user-provided limit directly to /usr/local/bin/tg_search without parsing it as an integer or enforcing the documented maximum of 50. Arbitrary strings, negative numbers, zero, and excessively large integers therefore reach the external program.

Argument-array execution prevents shell metacharacters from being interpreted by a shell, so this is not command injection. However, the wrapper relies entirely on an unaudited external executable to validate a security- and resource-relevant parameter.

Attack Path

  1. An attacker or untrusted caller invokes the Skill with a malformed or excessive limit, such as 1000000000, -1, or a non-numeric value.
  2. run.py stores the value as an unvalidated string.
  3. The wrapper passes the value unchanged to /usr/local/bin/tg_search.
  4. If the external utility does not impose its own strict bounds, it may attempt excessive processing or Telegram API activity, fail unexpectedly, or consume disproportionate resources.

Impact Assessment

Exploitation does not directly grant additional operating-system or Telegram privileges. The likely scope is availability and resource consumption within the Skill worker and the authorized Telegram account's API quota. Consequences may include excessive requests, Telegram rate limiting, process instability, unexpected errors, and degraded service for other ca ...[truncated 6 chars]

Remediation
View remediation

Remediation Suggestions

Parse and validate the limit before launching the subprocess:

python
try:
    limit = int(sys.argv[2]) if len(sys.argv) >= 3 else 10
except ValueError:
    print(json.dumps({"error": "limit must be an integer"}))
    sys.exit(1)

if not 1 <= limit <= 50:
    print(json.dumps({"error": "limit must be between 1 and 50"}))
    sys.exit(1)

p = subprocess.run(
    ["/usr/local/bin/tg_search", query, str(limit)],
    capture_output=True,
    text=True,
    timeout=30,
)

The underlying tg_search utility should independently enforce the same range as defense in depth. Add automated tests for zero, negative values, non-numeric input, values above 50, and valid boundary values.

T09 · Insecure Skill Coding Practices

Warning
Location
run.py:12
Finding

External Telegram Search Process Has No Execution Timeout

Content
View full analysis

Vulnerability Details

File Location: run.py:12-16
Vulnerability Type: Unbounded subprocess execution
Risk Level: Medium

Vulnerable Code

python
p = subprocess.run(
    ["/usr/local/bin/tg_search", query, limit],
    capture_output=True,
    text=True
)

Technical Analysis

subprocess.run waits for the child process to terminate unless a timeout is supplied. The invoked utility performs network-dependent Telegram operations, but the wrapper establishes no execution deadline.

A stalled Telegram connection, an internal deadlock, or a malfunctioning or compromised local executable can consequently keep the Skill worker occupied indefinitely. Capturing stdout and stderr also retains all generated output in memory until the process exits, potentially compounding resource consumption if the external program produces excessive output.

Attack Path

  1. An attacker submits a query that triggers slow or pathological behavior in the external utility, or repeatedly invokes the Skill while Telegram connectivity is impaired.
  2. /usr/local/bin/tg_search stalls or does not terminate.
  3. Because no timeout is configured, run.py waits indefinitely.
  4. Repeated concurrent requests can occupy available workers and degrade or deny service.

Exploitability through a particular query depends on the omitted implementation of /usr/local/bin/tg_search; ordinary network failure alone can still trigger the underlying availability weakness.

Impact Assessment

The issue primarily affects availability. It does not by itself provide elevated privileges or unauthorized Telegram access. Its scope includes the current Skill process and, under repeated or concurrent invocation, the worker pool or host resources allocated to the service. Potential consequences include indefinite worker retention, request backlog, memory consumption, and denial of service.

Remediation
View remediation

Remediation Suggestions

Configure a strict execution timeout and handle timeout failures without exposing sensitive details:

python
try:
    p = subprocess.run(
        ["/usr/local/bin/tg_search", query, str(limit)],
        capture_output=True,
        text=True,
        timeout=30,
        check=False,
    )
except subprocess.TimeoutExpired:
    print(json.dumps({"error": "tg_search timed out"}))
    sys.exit(1)

Also:

  • Apply request-level and user-level concurrency limits.
  • Limit the maximum captured output or stream it through a bounded reader.
  • Ensure timeout termination also cleans up descendant processes.
  • Add network-level timeouts inside the Telegram client.
  • Monitor timeout frequency and repeated abusive invocation patterns.

T07 · Tool Hijacking and Spoofing

Warning
Location
run.py:12
Finding

Security-Critical Behavior Is Delegated to an Unaudited Host Executable

Content
View full analysis

Vulnerability Details

File Location: run.py:12-16
Related Locations: SKILL.md:3-9, skill.json:4-5
Vulnerability Type: External tool trust and replacement risk
Risk Level: Medium

Vulnerable Code

run.py:12-16:

python
p = subprocess.run(
    ["/usr/local/bin/tg_search", query, limit],
    capture_output=True,
    text=True
)

SKILL.md:3-9:

markdown
Search public Telegram channels and groups by keyword using an already-authorized Telethon session on this VPS.

## What it does
- Runs global Telegram search for public channels/groups matching a query
- Returns up to `limit` results as JSON

## Command executed
`/usr/local/bin/tg_search "<query>" <limit>`

skill.json:4-5:

json
"description": "Search public Telegram channels/groups via local Telethon session (calls /usr/local/bin/tg_search).",
"entrypoint": "tg_search"

Technical Analysis

The repository does not include the implementation of /usr/local/bin/tg_search, although that executable performs all Telegram access and uses an already-authorized Telethon session. The audited wrapper therefore cannot establish whether the utility only searches public entities, how it protects session credentials, what additional filesystem or network operations it performs, or whether it has hidden side effects.

Using an absolute path is a positive control because it prevents ordinary PATH-based executable substitution. Nevertheless, the executable remains independently replaceable by any actor or deployment mechanism capable of modifying /usr/local/bin/tg_search. Such a replacement would alter the effective behavior without changing this reviewed package.

This finding does not prove that the existing host executable is malicious. It identifies a trust boundary and tool-replacement risk that cannot be resolved from the supplied source.

Attack Path

  1. An attacker first obtains ...[truncated 1536 chars]
Remediation
View remediation

Remediation Suggestions

  • Include the tg_search implementation in the reviewed and versioned package where feasible.
  • If it must remain external, verify a pinned cryptographic digest or signed artifact before execution.
  • Ensure the executable and its parent directories are owned by a trusted administrative account and are not writable by the Skill runtime.
  • Run the utility under a dedicated least-privileged account in a filesystem and network sandbox.
  • Store the Telethon session with restrictive permissions and grant only the Telegram capabilities required for public search.
  • Record and verify the external tool version during deployment.
  • Audit the omitted utility for session handling, network behavior, result filtering, input validation, and side effects.
  • Resolve or document the discrepancy between the packaged run.py wrapper and the skill.json entrypoint value of tg_search.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run.py (reported line 13)May include surrounding context.

python
query = sys.argv[1]
    limit = sys.argv[2] if len(sys.argv) >= 3 else "10"

    p = subprocess.run(
        ["/usr/local/bin/tg_search", query, limit],
        capture_output=True,
        text=True

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comment on L05 is written only in Russian, which imposes a specific language in the skill's natural-language content without offering any user choice or documenting a region-specific reason. This matches the locale/language policy violation category because the file contains natural-language guidance that is not language-neutral or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.