Security Audit Report

Security Score: 0/100

telegram-usage

Risk Level: High Risk
Auditor: c-drew
Files: 6
Audit Date: 4/30/2026, 3:06:35 PM
Continuous Monitoring: ClawSecure Watchtower

Findings Overview

  • Total Findings: 10
  • Critical: 2
  • High: 6
  • Medium: 1
  • Low: 0
  • Info: 1

Source: Link to detailed report
SHA-256: 3eca91a607cf...

3-Layer Audit Protocol

🛡 ClawSecure Proprietary Engine

  • Finding: Missing config.json - agent may not be properly configured
  • Warning: 1 finding

🔒 Advanced Static & Behavioral Analysis

  • Findings: Only 61% of skill content could be analyzed. 2 of 6 files are opaque to the scanner. The safety assessment has low confidence.
  • Additional Findings:
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
    • Pattern detected: require('child_process') +3 more
  • Critical Findings: 9 findings

📦 Supply Chain Security

  • Status: No issues detected
  • Findings: 0 findings

CRITICAL Findings

  • F-001: Pattern detected: require('child_process')
    • File: handler.js:10
    • Pattern Detected: require('child_process')
  • F-002: Pattern detected: execSync(
    • File: handler.js:48
    • Pattern Detected: execSync(

HIGH Findings

  • F-001: Only 61% of skill content could be analyzed. 2 of 6 files are opaque to the scanner. The safety assessment has low confidence.
  • F-002: Pattern detected: fs.writeFileSync(
    • File: handler.js:118
  • F-003: Pattern detected: fs.readFileSync(
    • File: handler.js:126
  • F-004: Pattern detected: fs.writeFileSync(
    • File: handler.js:151
  • F-005: Pattern detected: fs.readFileSync(
    • File: session-reader.js:80
  • F-006: Pattern detected: fs.readFileSync(
    • File: session-reader.js:115

MEDIUM Finding

  • F-001: Missing config.json - agent may not be properly configured
    • Category: ASI03 OWASP ASI: Identity & Privilege Abuse

INFO Finding

  • F-001: Skill manifest does not include a 'license' field.
    • File: SKILL.md

OWASP ASI Framework Coverage

  • ASI01: Agent Goal Hijack
  • ASI02: Tool Misuse
  • ASI03: Identity & Privilege
  • ASI04: Agentic Supply Chain
  • ASI05: Unexpected Code Execution
  • ASI06: Memory & Context
  • ASI07: Insecure Inter-Agent Communication
  • ASI08: Cascading Failures
  • ASI09: Human-Agent Trust Exploitation
  • ASI10: Rogue Agents

Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — differentiating real threats from normal agent functionality.

Security Recommendations for telegram-usage

  1. Pin npm dependencies to exact versions: Unpinned dependencies allow supply chain attacks. Use exact version numbers in package.json to prevent unauthorized code from entering your dependency tree.
  2. Add a config.json permissions manifest: Including a config.json file improves visibility into what your skill can do before installation.
  3. Review shell execution permissions: Validate that commands constructed from trusted inputs; avoid passing user-controlled strings directly to shell commands.

Scanned Information

  • Audit Date: April 30, 2026
  • Total Agents Audited by ClawSecure: 2,890+

Re-scan telegram-usage for latest security updates →