telegram-auto-topic
3 findings (1 high, 2 medium), mainly data exfiltration, command injection, unauthorized tool use. Most recent scan 2026-02-07.
This Telegram Auto-Topic skill presents MEDIUM-HIGH security risks primarily related to credential exposure, command injection vulnerabilities, and undisclosed external dependencies. The skill requires a pre-configured Telegram bot with admin permissions and makes external API calls, but these requirements are not clearly disclosed in the manifest. The bash script handles user-controlled input (sender names, message content) without sufficient sanitization, creating command injection risks. Most critically, the bot token is read from a predictable file location without encryption or access controls, potentially exposing full bot control to unauthorized parties. The skill would benefit from: explicit security disclosures in the manifest, input validation and sanitization, proper credential management, and comprehensive error handling. While the core functionality (creating Telegram forum topics) is legitimate, the implementation has security gaps that should be addressed before production use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Add `/topic` to the start of any message in a Telegram forum group to auto-create a new topic from it. A title is generated automatically from the message content.
- Package
- 2 files, 8.9 KB
- SKILL.md
- 555 words, 8 sections
- Code
- Shell (1)
SKILL.md covers: Telegram Auto-Topic · Example · Prerequisites · Handling /topic · How It Works · Script Reference · Optional: Register Telegram command · Limitations
Findings
HIGH Hardcoded Bot Token Exposure Risk Data Exfiltrationllm
The script reads the Telegram bot token from a configuration file at a predictable location ($HOME/.openclaw/openclaw.json). If this skill is distributed or shared, it could expose the bot token to unauthorized parties. The token provides full control over the Telegram bot, allowing message sending, group manipulation, and potential data exfiltration through the bot's API access.
scripts/telegram-auto-topic.sh
BOT_TOKEN=$(jq -r '.channels.telegram.botToken // empty' "$CONFIG_FILE")
if [ -z "$BOT_TOKEN" ]; then
echo "ERROR: Bot token not found in $CONFIG_FILE" >&2
exit 1
fiMEDIUM Command Injection Risk in Shell Script Arguments Command Injectionllm
The bash script accepts user-controlled input (sender name, title, text) as command-line arguments and uses them in curl commands without proper sanitization. While the script uses jq for JSON encoding, the arguments are passed through shell variable expansion which could allow command injection if special characters are not properly escaped. An attacker could craft malicious input in the sender name or message content to inject shell commands.
scripts/telegram-auto-topic.sh
./telegram-auto-topic.sh <chat_id> <message_id> <sender> [title] [text]
These arguments are used in curl commands with variable expansion, potentially allowing injection through special characters in sender names or message content.MEDIUM Unauthorized External API Access Unauthorized Tool Usellm
The skill makes direct HTTP requests to the Telegram API (api.telegram.org) using curl, which constitutes network access. The YAML manifest does not declare 'allowed-tools', and the description does not clearly indicate that external network calls will be made. This represents unauthorized tool use as the skill performs network operations that may not be expected by users based on the description alone.
scripts/telegram-auto-topic.sh:38
API="https://api.telegram.org/bot$BOT_TOKEN"
The script makes multiple curl requests to external Telegram API endpoints without explicit user consent for each operation.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.6 KB |
scripts/telegram-auto-topic.sh | script | 5.3 KB |
External hosts referenced
t.me api.telegram.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
CHAT_ID TOPIC_ID CONFIG_FILE BOT_TOKEN MESSAGE_ID OPENCLAW_CONFIG STRIPPED_ID
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/telegram-auto-topic
- Raw scan result: telegram-auto-topic-scan.json
- Badge for your README:
- Request a re-scan