ClawHub
Back to skill

Security audit

Telegram CLI

Security checks for vulnerabilities and agentic risk

Overview

This Telegram skill appears purpose-aligned, but it asks for sensitive account access and enables live messaging and chat export with limited safety and storage details.

Review this carefully before installing. Use it only if you are comfortable granting a CLI access to your Telegram account, private messages, contacts/groups, and the ability to send messages. Prefer a pinned reviewed package version or commit, inspect the installed package, confirm where sessions are stored, and remove stored credentials when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package and Mutable Source Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22-29; README.md:5-16; README.md:109-114
Vulnerability Type: Supply-chain exposure through unpinned dependencies and mutable remote source
Risk Level: Medium

Vulnerable Code

SKILL.md:22-29:

bash
npm install -g @cyberdrk/tg

Or from source:

bash
cd ~/Code/cyberdrk305/telegram && npm install && npm run build && npm link

README.md:5-16:

bash
npm install -g @cyberdrk/tg

Or install from source:

bash
git clone https://github.com/cyberdrk305/telegram.git
cd telegram
npm install
npm run build
npm link

README.md:109-114:

bash
mkdir -p ~/.claude/skills
ln -s $(npm root -g)/@cyberdrk/tg/SKILL.md ~/.claude/skills/tg.md

Or if installed from source:

bash
ln -s ~/Code/cyberdrk305/telegram/SKILL.md ~/.claude/skills/tg.md

Technical Analysis

The installation instructions retrieve either the latest available version of the @cyberdrk/tg npm package or the mutable default branch of a remote GitHub repository. They do not specify a reviewed package version, immutable commit hash, integrity checksum, or other provenance-verification mechanism.

An npm installation can execute package lifecycle scripts. The source-based procedure additionally executes npm install and npm run build against remotely obtained content, then globally exposes the resulting tool through npm link. The Claude Code installation instructions subsequently link the installed package's SKILL.md into an agent skill directory. Consequently, a future package release or repository modification can differ from the content reviewed in this audit and may become trusted local agent instructions.

The supplied project contains only documentation, so there is no implementation, lockfile, package manifest, lifecycle script, or credential-storage code available to verify. This finding th ...[truncated 1929 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm dependency to an explicitly reviewed version rather than installing an unconstrained latest release:
    bash
    npm install -g @cyberdrk/tg@X.Y.Z
  2. For source installations, pin and verify an immutable commit:
    bash
    git clone https://github.com/cyberdrk305/telegram.git
cd telegram
git checkout --detach VERIFIED_COMMIT_SHA
  3. Publish trusted SHA-256 checksums or signed release artifacts and require verification before installation.
  4. Commit a lockfile and use deterministic installation such as npm ci rather than unconstrained npm install.
  5. Audit package lifecycle and build scripts before execution. Where compatible, initially install with lifecycle scripts disabled:
    bash
    npm ci --ignore-scripts
  6. Avoid global installation and npm link unless operationally necessary. Prefer an isolated, least-privileged environment or a dedicated user account.
  7. Copy a reviewed, versioned skill file into the agent's skill directory instead of symlinking mutable package content, or verify its integrity every time the package changes.
  8. Document package provenance, expected publisher identity, release-signing procedures, reviewed versions, and rollback instructions.
  9. Restrict permissions on Telegram credential and session storage, and ensure installation or build scripts cannot access production credentials during package evaluation.
  10. Add automated dependency scanning, lockfile integrity validation, and release provenance checks to the publication workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

The authentication flow requires long-lived Telegram API credentials and a session, implying local session persistence for continued access. In a messaging skill handling private communications, persisted credentials materially increase risk if the host is compromised, especially since the README does not clearly describe storage protections, revocation guidance, or operational safeguards.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md
First, get your API credentials:
1. Go to https://my.telegram.org/apps
2. Log in with your phone number
3. Create a new application
4. Copy the `api_id` and `api_hash`

Then authenticate:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README promotes sending messages and synchronizing chats without warning that these actions transmit user content to Telegram and may persist conversation data locally. In an AI-agent context, omission of data handling warnings is more dangerous because an agent may invoke these commands on sensitive chats without the operator appreciating the privacy and retention implications.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

bash
# Symlink the skill to your Claude skills directory
mkdir -p ~/.claude/skills
ln -s $(npm root -g)/@cyberdrk/tg/SKILL.md ~/.claude/skills/tg.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The authentication section instructs users to provide Telegram API credentials and authenticate the CLI, but it omits any privacy or account-access warning. Without clear notice that the tool will gain access to message data and account capabilities, users may underestimate the sensitivity of the credentials and session, increasing the chance of overbroad trust or mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents message-sending commands but does not warn that these commands will cause real external actions on the user's Telegram account. In an agent setting, this increases the risk of unintended outbound communication, user impersonation, or accidental disclosure if the tool is invoked without explicit user awareness and confirmation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest limits the skill's purpose to reading, searching, sending messages, and looking up contacts/groups. The documented tg sync command adds a distinct archival/export behavior ('Sync last 7 days to markdown') that goes beyond simple message access and messaging operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The README asserts that session data is 'encrypted and stored securely' without substantiation in this file. Overstated security guarantees can cause users or agents to trust the tool with sensitive Telegram credentials and message history under false assumptions, increasing the likelihood of unsafe handling of secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.