Channel Reminders

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:04 PM UTC
• Version: 1.3.0

Overview

The skill is for Telegram reminders, but it asks users to install persistent messaging rules that can send Telegram messages from future system events without validation.

Install only if you understand and accept that this skill modifies persistent agent behavior and can send Telegram messages through configured bot accounts. Before use, replace the hardcoded Chat ID, avoid storing Chat IDs in general memory, add explicit recipient/account allowlists and event validation, and keep an auditable record instead of suppressing all output with NO_REPLY.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:296
• Finding: Persistent Modification of Main-Agent Heartbeat Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:296-334` **Vulnerability Type**: Persistent agent-state modification **Risk Level**: High ### Vulnerable Code ```markdown ### Если раздела нет — добавь: ### Напоминания от других агентов (📤 ОТПРАВИТЬ НАПОМИНАНИЕ) Когда получаешь systemEvent с `📤 ОТПРАВИТЬ НАПОМИНАНИЕ:` — это запрос от НЕ-main агента отправить сообщение через их бота. **Формат:** ``` 📤 ОТПРАВИТЬ НАПОМИНАНИЕ: accountId: semen target: 7977422300 message: 🤗 текст напоминания ``` **Действие:** Используй `message` tool: ```json { "action": "send", "channel": "telegram", "accountId": "<accountId из systemEvent>", "target": "<target из systemEvent>", "message": "<message из systemEvent>" } ``` Ничего больше не отвечай после отправки (NO_REPLY). ``` ### Technical Analysis The skill directs the user or agent to add durable behavioral rules to the main agent's `HEARTBEAT.md`. These rules survive the immediate skill invocation and instruct future agent sessions to recognize specially formatted system events, invoke the privileged `message` tool, and suppress ordinary output by returning `NO_REPLY`. The persistent rule does not require authentication of the event producer or verification that the event originated from an authorized reminder job. Consequently, any actor or compromised component capable of introducing a matching system event could potentially trigger the durable relay behavior. Although persistent configuration is relevant to the intended reminder functionality, placing an unrestricted tool-execution rule in shared agent instructions expands the security boundary beyond an individual reminder. ### Attack Path 1. The skill's instructions are followed and the supplied rule is added to the main agent's persistent `HEARTBEAT.md`. 2. An attacker gains the ability to create, alter, or inject a system event into the main agent's event stream. 3. The attacker formats the event with the expected `📤 ОТПРАВИТЬ Н ...[truncated 939 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not place generic tool-execution instructions in shared, persistent agent files. - Implement reminder delivery in a scoped handler with an explicit and validated event schema. - Authenticate the event producer and cryptographically or structurally bind each event to the job that created it. - Record the authorized bot account and recipient when the reminder is created; do not permit an event to override them at delivery time. - Maintain an allowlist of permitted `accountId` values and recipient identifiers. - Require explicit user approval before enabling a new account or destination. - Remove the `NO_REPLY` requirement for security-sensitive failures and retain an auditable delivery log. - Provide a documented procedure for removing all persistent instructions when the skill is disabled. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:313
• Finding: Unvalidated System-Event Fields Are Passed to a Privileged Messaging Tool<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:313-334` **Vulnerability Type**: Unvalidated privileged tool invocation **Risk Level**: High ### Vulnerable Code ```markdown **Формат:** ``` 📤 ОТПРАВИТЬ НАПОМИНАНИЕ: accountId: semen target: 7977422300 message: 🤗 текст напоминания ``` **Действие:** Используй `message` tool: ```json { "action": "send", "channel": "telegram", "accountId": "<accountId из systemEvent>", "target": "<target из systemEvent>", "message": "<message из systemEvent>" } ``` Ничего больше не отвечай после отправки (NO_REPLY). ``` ### Technical Analysis The instructions copy all security-sensitive message parameters directly from free-form system-event text into the `message` tool call. The selected bot identity, destination, and message body are therefore controlled by the event. No origin verification, authorization check, recipient binding, account allowlist, schema validation, or confirmation step is specified. The marker and field names function only as a parsing convention and do not provide authentication. The instruction to return `NO_REPLY` after sending further weakens operational transparency because an unauthorized or incorrectly routed delivery may not appear in the ordinary chat response. ### Attack Path 1. An attacker obtains a path to inject or modify a system event, cron payload, or other input consumed by the heartbeat handler. 2. The attacker supplies the recognized marker followed by a bot account available to the agent, an attacker-selected Telegram Chat ID, and arbitrary message content. 3. The main agent parses the values according to the documented format. 4. The agent calls the privileged `message` tool without independently verifying the account, recipient, event origin, or reminder owner. 5. Telegram sends the attacker-controlled content using the selected bot identity. 6. The handler suppresses its normal response with `NO_REPLY`. ### Impact Assessment An attacker could potent ...[truncated 466 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace free-form event parsing with a strict, typed schema. - Attach an authenticated creator identity and immutable job identifier to each event. - Resolve the authorized account and recipient from protected job configuration rather than from event text. - Allowlist valid bot accounts and reject unknown `accountId` values. - Verify that the destination is owned by or explicitly approved for the requesting user. - Apply length and character restrictions to messages and prevent control fields from being embedded in message content. - Require confirmation for first-time recipients, account changes, or high-risk messages. - Log the requesting identity, job ID, account, destination, time, result, and validation decision. - Report rejected or anomalous events rather than suppressing all output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:76
• Finding: User Telegram Chat ID Is Directed into Long-Term Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:76-85` **Vulnerability Type**: Persistent storage of a personal routing identifier **Risk Level**: Medium ### Vulnerable Code ```markdown После тестов **запиши в память** какой подход работает: **Пример записи в `MEMORY.md` или `memory/YYYY-MM-DD.md`:** ```markdown ## Напоминания **Рабочий подход:** sessionTarget: "main" + systemEvent + wakeMode: "now" **Проверено:** 2026-02-14 **Chat ID пользователя:** 7977422300 ``` ``` ### Technical Analysis The skill explicitly instructs the agent to write a user's Telegram Chat ID into `MEMORY.md` or a dated long-term memory file. A Chat ID is a persistent platform routing identifier and may constitute personal or sensitive metadata when associated with a user. Conversational memory may be loaded into unrelated future sessions, processed by other skills, included in workspace backups, or exposed to users and processes with workspace access. The instructions do not define user consent, retention limits, access controls, encryption, deletion, or redaction. The operating mode may need durable routing configuration, but general-purpose agent memory is not an appropriately scoped secrets or identity store. ### Attack Path 1. The user tests the reminder workflow. 2. Following the skill instructions, the agent writes the user's Chat ID into a persistent memory file. 3. The memory remains available after the reminder setup session ends. 4. A later agent session, another skill, a workspace reader, or a backup process accesses the memory file. 5. The stored identifier is disclosed, correlated with other user information, or reused as a messaging destination without fresh consent. ### Impact Assessment The primary impact is privacy loss and unauthorized reuse of a durable user identifier. Exposure could facilitate unwanted messaging, cross-session user correlation, or accidental disclosure in future agent output. This storage instruction does not itself exp ...[truncated 166 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not store Chat IDs in `MEMORY.md` or general conversational memory. - Use a dedicated, access-controlled configuration or credential store scoped to the reminder service. - Store an opaque recipient alias where possible and resolve it through protected configuration at delivery time. - Obtain explicit user consent before retaining a routing identifier. - Define retention and deletion procedures and remove the identifier when the related reminders are deleted. - Restrict access to the configuration and avoid including identifiers in logs, prompts, examples, or backups unless necessary. - Encrypt sensitive configuration at rest where supported. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:225
• Finding: Copy-Ready Examples Contain a Concrete Telegram Recipient ID<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:225-235` **Vulnerability Type**: Hardcoded personal routing identifier in an operational example **Risk Level**: Medium ### Vulnerable Code ```json { "agentId": "main", "name": "Утреннее напоминание от Semen", "schedule": { "kind": "cron", "expr": "0 9 * * *", "tz": "Europe/Moscow" }, "sessionTarget": "main", "wakeMode": "now", "payload": { "kind": "systemEvent", "text": "📤 ОТПРАВИТЬ НАПОМИНАНИЕ:\naccountId: semen\ntarget: 7977422300\nmessage: 🤗 Доброе утро! Проверь задачи на сегодня." } } ``` The same concrete ID also appears in other examples, including `SKILL.md:84`, `SKILL.md:131`, `SKILL.md:249`, and `SKILL.md:319`. ### Technical Analysis The documentation repeatedly embeds the concrete Telegram Chat ID `7977422300` in copy-ready cron and messaging examples. Unlike an unmistakable placeholder, the numeric value is syntactically valid and can be executed without modification. Agents and users frequently reuse documentation examples directly. If the embedded ID belongs to an actual account, an unchanged example can route messages to that account. Repeated use across the document increases the likelihood that the value will be treated as a default rather than illustrative data. ### Attack Path 1. A user or agent copies one of the provided cron or message examples. 2. The example is executed without replacing `7977422300`. 3. The cron job triggers or the direct message action runs. 4. Telegram routes the message to the embedded Chat ID rather than the intended user's chat. 5. Reminder content is disclosed to the unintended recipient, and recurring jobs may continue sending additional messages. ### Impact Assessment The issue can cause accidental third-party messaging, privacy loss, spam, and repeated disclosure of reminder content. With recurring cron examples, the impact can persist until the job is discovered and removed. The scope is limited to messages sent ...[truncated 121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace every occurrence of the concrete ID with an unmistakable placeholder such as `USER_CHAT_ID_HERE`. - Add validation that rejects unresolved placeholders and known example values. - Require explicit recipient selection or confirmation before creating a job or sending a test message. - Display the resolved destination to the user before activation. - Ensure tests use a user-provided destination rather than a package-defined default. - Add automated secret and personal-identifier scanning to prevent concrete IDs from being published in future versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill is built around delivering reminder contents to Telegram, a third-party service, but does not include a user-facing warning that reminder text and routing data will be transmitted externally. Even expected transmissions should be disclosed when they may contain personal or sensitive content.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The entire skill description and prescribed message formats are written in Russian, including fixed example reminder texts and HEARTBEAT instructions. There is no indication that the user can opt into another language or that this is a region-specific skill with a documented justification.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly tells the agent to persist the user's Telegram Chat ID in memory files. Storing persistent user identifiers is unnecessary for many reminder flows and increases privacy risk, especially if memory is shared, retained indefinitely, or later reused for unrelated messaging.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs storing a user's Telegram Chat ID in memory without any privacy notice, consent language, or retention guidance. Because chat IDs are user-linked identifiers, silent persistence creates an avoidable privacy and compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill instructs retrieving Telegram chat IDs via direct Bot API queries, expanding data-access scope beyond simply scheduling reminders. This can expose message metadata and user identifiers from bot updates, and encourages broader API/data access than is necessary for the core task.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Где взять:**
```bash
curl "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" | jq '.result[].message.chat.id'
```

**Или из metadata сообщения** — в заголовке Telegram сообщения виден `id:XXXXXXXX`

• Confidence: 85% confidence
• Finding: The skill includes explicit instructions to use curl against the Telegram Bot API, which is an external transmission path not strictly required for the reminder logic itself. Combined with the getUpdates endpoint, this can reveal broader message/update data and normalize unnecessary outbound data access in the agent workflow.

Static analysis

No suspicious patterns detected.