Security audit

Telebiz Mcp

Security checks across malware telemetry and agentic risk

Overview

The skill’s Telegram automation purpose is real and mostly disclosed, but it exposes the authenticated Telegram session through unauthenticated local network services.

Install only if you trust the machine and can restrict ports 9716, 9717, and 9718 to loopback. Add authentication or firewall rules before use, and avoid enabling destructive/admin Telegram tools unless you need them and can review each action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation indicates capabilities that require environment access, networking, and shell execution, but it does not declare permissions accordingly. This undermines security review and least-privilege controls because a consumer may trust the stated purpose while the skill can start local services, open ports, and invoke scripts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose frames the skill as simple Telegram MCP access, but the document also describes a persistent HTTP server, WebSocket relay, subprocess lifecycle management, monitoring, and request-rewriting behavior. That broader operational behavior materially increases attack surface by adding long-lived local services and control paths that are not obvious from the top-level description.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The skill is presented as a Telegram-access integration, but the documentation also references CRM/entity-linking functions that extend data access and integration scope beyond messaging. Hidden or under-disclosed cross-system capabilities can cause unintended data exposure or misuse because reviewers may not assess the additional trust boundary with the same scrutiny.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The daemon exposes a localhost HTTP API that can invoke arbitrary MCP tools by name and pass attacker-controlled arguments directly to the authenticated Telegram session. Even though it is bound to the local machine, there is no access control, allowlist, or origin validation, so any local process—or a website exploiting localhost access in the user's browser—could drive sensitive Telegram actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The /call endpoint is unauthenticated and accepts JSON input that is forwarded into tool execution with the user's authenticated Telegram context. This creates a local privilege boundary break: malware, another local user, or potentially browser-based localhost requests can send messages, read chats, search data, or modify folders without the user's consent.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The server sets `Access-Control-Allow-Origin: *` and exposes `/mcp` with no authentication, allowing any website or local network client that can reach the port to invoke Telegram tools through the already-authenticated session. In this skill's context, that means unauthorized parties could read chats, search messages, modify folders, or send messages as the user, making the exposure especially dangerous.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The MCP server exposes substantially broader capabilities than the stated skill description implies, including destructive actions like deleteChat/deleteMessages/deleteFolder and administrative actions like add/remove members, createGroup, archive/pin/mute operations, and bulk actions. This scope mismatch is dangerous because users or downstream agents may grant trust based on the manifest/description while the implementation can perform higher-risk operations on an authenticated Telegram session.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The relay lets any WebSocket peer self-identify as either a client or the privileged executor with a simple JSON registration message, and then forwards arbitrary requests with no authentication, authorization, origin validation, or session binding. In this skill's context, the executor is an authenticated Telegram browser session, so an attacker who can reach the relay can impersonate a client to read/send Telegram data or replace the executor entirely, resulting in account misuse and data exposure.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The daemon intentionally adds a separate HTTP control plane beyond the MCP interface described in the skill metadata. That expands the attack surface by making Telegram-capable tool invocation accessible through a generic local web API, which can be reached by other local processes and, in some environments, by browser-based requests from localhost.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The HTTP server accepts POST requests to /call and forwards arbitrary tool names and arguments to the MCP process with no authentication, authorization, or origin validation. Because this skill has access to an authenticated Telegram session, any local process—and potentially browser content via localhost access patterns—could trigger message reads, searches, folder changes, or message sending as the user.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The server exposes an authenticated Telegram MCP interface over plain HTTP with no authentication, authorization, or network binding restriction. Any process or user that can reach this port can invoke MCP tools to read chats/messages or send Telegram messages through the already-authenticated session, which is especially dangerous given the skill’s purpose is direct access to private Telegram data and actions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The server exposes a much broader set of Telegram capabilities than the declared skill description suggests, including destructive and account-modifying actions such as deleting chats/messages, changing notification state, altering membership, and creating groups. This mismatch undermines user trust and consent because an orchestrating agent or reviewer may authorize the skill expecting read/list/send behavior while the implementation can perform materially more sensitive actions.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The relay exposes a `status` message type to any connected WebSocket before authentication or role validation, disclosing executor presence, client counts, pending requests, uptime, and metrics. In a service that brokers access to an authenticated Telegram session, this information can aid unauthorized users in reconnaissance and confirm when a live executor is available to abuse.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The endpoint silently accepts tool names and arguments and forwards them for execution, with no user confirmation, audit gate, or warning despite operating on sensitive Telegram data. In this skill context, hidden message reads/sends and metadata searches are especially dangerous because the daemon is attached to a live authenticated messaging session.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This server forwards Telegram tool arguments and results over a WebSocket relay, which may include sensitive chat contents, user identifiers, and message metadata, but there is no user-facing disclosure, trust boundary notice, or transport hardening in this file. Even though the default relay is localhost, the URL is environment-configurable and plain ws:// is allowed, creating risk of unintended data exposure if redirected to a remote or intercepted endpoint.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The daemon exposes network-invocable execution of Telegram actions without prompting the user or clearly warning that an HTTP listener can drive the authenticated session. In this context, silent forwarding is dangerous because the tools operate on sensitive communications data and can perform side effects like sending messages.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Tool arguments are sent over a WebSocket relay, which may include sensitive Telegram data such as chat IDs, search queries, usernames, and message contents, yet the skill provides no user-facing disclosure or trust boundary explanation. Because the default relay URL uses unencrypted ws:// transport, this also increases the risk of interception or unintended local relay abuse if the endpoint is not tightly controlled.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 2 advisory(ies): CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: @modelcontextprotocol/sdk==1.0.0

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: ws==8.18.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/daemon.js:36

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/http-server.js:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/daemon.ts:43

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/http-server.ts:40

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/daemon.js:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/daemon.ts:21