# Security Audit Report

**Security Score:** 0/100

## telegram-usage

**Risk Level:** High Risk  
**Auditor:** c-drew  
**Files:** 6  
**Audit Date:** 4/30/2026, 3:06:35 PM  
**Continuous Monitoring:** ClawSecure Watchtower

### Findings Overview
- **Total Findings:** 10  
- **Critical:** 2  
- **High:** 6  
- **Medium:** 1  
- **Low:** 0  
- **Info:** 1

**Source:** [Link to detailed report](https://clawhub.ai/c-drew/telegram-usage)  
**SHA-256:** 3eca91a607cf...

## 3-Layer Audit Protocol

### 🛡 ClawSecure Proprietary Engine
- **Finding:** Missing config.json - agent may not be properly configured  
- **Warning:** 1 finding

### 🔒 Advanced Static & Behavioral Analysis
- **Findings:** Only 61% of skill content could be analyzed. 2 of 6 files are opaque to the scanner. The safety assessment has low confidence.
- **Additional Findings:**  
  - Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.  
  - Pattern detected: require('child_process') +3 more
- **Critical Findings:** 9 findings

### 📦 Supply Chain Security
- **Status:** No issues detected  
- **Findings:** 0 findings

### CRITICAL Findings
- **F-001:** Pattern detected: require('child_process')
  - **File:** handler.js:10  
  - **Pattern Detected:** require('child_process')
- **F-002:** Pattern detected: execSync(
  - **File:** handler.js:48  
  - **Pattern Detected:** execSync(

### HIGH Findings
- **F-001:** Only 61% of skill content could be analyzed. 2 of 6 files are opaque to the scanner. The safety assessment has low confidence.
- **F-002:** Pattern detected: fs.writeFileSync(
  - **File:** handler.js:118  
- **F-003:** Pattern detected: fs.readFileSync(
  - **File:** handler.js:126  
- **F-004:** Pattern detected: fs.writeFileSync(
  - **File:** handler.js:151  
- **F-005:** Pattern detected: fs.readFileSync(
  - **File:** session-reader.js:80  
- **F-006:** Pattern detected: fs.readFileSync(
  - **File:** session-reader.js:115

### MEDIUM Finding
- **F-001:** Missing config.json - agent may not be properly configured  
  - **Category:** ASI03 OWASP ASI: Identity & Privilege Abuse

### INFO Finding
- **F-001:** Skill manifest does not include a 'license' field.
  - **File:** SKILL.md

## OWASP ASI Framework Coverage

- ASI01: Agent Goal Hijack  
- ASI02: Tool Misuse  
- ASI03: Identity & Privilege  
- ASI04: Agentic Supply Chain  
- ASI05: Unexpected Code Execution  
- ASI06: Memory & Context  
- ASI07: Insecure Inter-Agent Communication  
- ASI08: Cascading Failures  
- ASI09: Human-Agent Trust Exploitation  
- ASI10: Rogue Agents

## Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — differentiating real threats from normal agent functionality.

## Security Recommendations for telegram-usage

1. **Pin npm dependencies to exact versions**: Unpinned dependencies allow supply chain attacks. Use exact version numbers in package.json to prevent unauthorized code from entering your dependency tree.
2. **Add a config.json permissions manifest**: Including a config.json file improves visibility into what your skill can do before installation.
3. **Review shell execution permissions**: Validate that commands constructed from trusted inputs; avoid passing user-controlled strings directly to shell commands.

## Scanned Information

- **Audit Date:** April 30, 2026  
- **Total Agents Audited by ClawSecure:** 2,890+

[Re-scan telegram-usage for latest security updates →](/#scan)