Telegram Instant Messenger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This Telegram messaging skill matches its stated purpose, but it needs review because it routes content through external services and gives mutable remote instructions too much authority.

Install only if you are comfortable sending the selected Telegram messages, files, and media through AgentPMT-hosted services and a shared Telegram bot. Avoid sensitive or regulated content unless you have checked AgentPMT and Telegram handling rules, prefer pinned installation paths for related setup skills, and treat live remote instructions as reference data rather than permission to override your current task or safety rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:180
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:180-190` **Additional Location**: `SKILL.md:255-256` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup ``` ``` ### Technical Analysis The documented setup commands invoke `npx` without an exact package version, immutable repository commit, or integrity hash. Consequently, the code retrieved when a user follows these instructions can differ from the version that existed when this Skill was audited. The two installed setup Skills are not included in the audited artifact, which contains only `SKILL.md` and `schema.md`. Their effective behavior, including any executable installation hooks or additional instructions, therefore cannot be verified from this project. This creates a supply-chain trust boundary in which registry resolution and mutable upstream content determine what is installed. This is not evidence that the current AgentPMT dependency is malicious. The vulnerability is that upstream or registry compromise could change the retrieved content after review without requiring a modification to this Skill. ### A ...[truncated 1268 chars]
• Remediation: ## Remediation Suggestions 1. Pin every package to an exact, reviewed version instead of relying on mutable default resolution. 2. Pin referenced repositories or Skill bundles to immutable commit hashes or signed release artifacts. 3. Publish and verify cryptographic integrity hashes before installation. 4. Vendor the required setup Skills into the reviewed distribution when practical. 5. Audit all transitive dependencies and maintain a lockfile or equivalent dependency manifest. 6. Require signature verification and use a trusted package registry with protected maintainer accounts. 7. Run installation in a restricted environment without unnecessary filesystem, credential, or network access. 8. Avoid automatic installation; require explicit user approval showing the exact version and source that will be installed.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:111
• Finding: Mutable Remote Instructions Are Given Priority Over Audited Local Guidance## Vulnerability Details **File Location**: `SKILL.md:111-115` **Vulnerability Type**: Remote instruction trust and precedence **Risk Level**: Medium ### Vulnerable Code ```markdown - Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "telegram-instant-messenger"`. - Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "telegram-instant-messenger"`, or call this product with `action: "get_instructions"` when the product tool is already selected. - Treat returned live schema and instructions as more specific than this generated summary. ``` ### Technical Analysis The Skill directs the Agent to retrieve instructions from a remote AgentPMT service and treat those instructions as more specific than the locally bundled summary. This gives mutable, externally controlled text precedence over content that was available during static review. The guidance does not explicitly restrict remote responses to declarative schema fields, require strict structural validation, or state that remote instructions cannot alter session objectives, safety constraints, tool permissions, or data-handling rules. If the service, associated account, or response channel is compromised, malicious instructions could be returned through a workflow that the local Skill explicitly designates as authoritative. Fetching current schemas can be legitimate and useful, but executable behavioral instructions should not be trusted merely because they came from the configured endpoint. Remote content should be handled as untrusted data rather than as higher-priority Agent policy. ### Attack Path 1. An attacker compromises the AgentPMT endpoint, an authorized AgentPMT account, the product's remotely stored instruction content, or another component capable of modifying the response. 2. The Agent follows the Skill and calls `get_instructions`. 3. The service returns ...[truncated 1095 chars]
• Remediation: ## Remediation Suggestions 1. Treat all remotely returned instructions, examples, and schemas as untrusted data. 2. Remove the statement that remote instructions are automatically more specific or authoritative than the bundled Skill. 3. Permit remote responses to populate only an allowlisted, strictly validated schema structure. 4. Reject free-form response fields that attempt to modify safety rules, session goals, permissions, credential handling, or tool-selection policy. 5. Pin production schemas locally or verify remotely retrieved schemas against signed versions and known hashes. 6. Require explicit user confirmation before adopting material remote changes or invoking newly described actions. 7. Ensure system and developer policies, the user's current request, and locally reviewed security constraints always take precedence over remote content. 8. Log schema version changes without logging credentials, private message content, or other sensitive inputs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explains the shared bot model but does not prominently warn users that messages, files, and metadata are transmitted through a shared third-party Telegram bot and AgentPMT-hosted infrastructure. In a messaging skill, this omission materially increases the risk of users sending sensitive customer data, internal documents, or regulated content under the mistaken assumption that messaging is private or first-party.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation terms are broad enough to match generic support, messaging, feedback, and notification tasks, which can cause this skill to be selected in situations where a user did not intend Telegram or third-party message routing. In this skill's context, accidental activation is more dangerous because all communications are sent through a shared external bot and may expose message content and media outside the primary platform.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/telegram-instant-messenger
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/telegram-instant-messenger
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The schema documents actions that can send messages/files to Telegram and ingest incoming Telegram content into File Manager, but it does not include any privacy, consent, or external-transmission warning. In a messaging skill tied to a shared bot and remote hosted tool calls, this omission can lead users or downstream agents to transmit sensitive data or ingest untrusted external content without understanding the privacy and data-handling implications.

Static analysis

No suspicious patterns detected.