Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Telegram checklist tool that uses a user Telethon session, with meaningful allowlist controls and no evidence of hidden or destructive behavior.
Install only if you are comfortable giving this skill access to a Telethon user session that can read and modify native checklists in Saved Messages and explicitly allowlisted Telegram groups/topics. Keep TELETHON_CHECKLIST_CHATS narrow, protect the session file, and do not put secrets or personal data into checklist items.
The public description understates the actual behavior: beyond create/append/toggle, the skill can read checklist state, enumerate topics, consume Telegram API credentials, and process plan files. This mismatch can mislead operators into granting or invoking the skill with less scrutiny than a credentialed write-capable Telethon client deserves, enabling unauthorized or unexpected data access/actions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
state under "verified"; non-fatal issues are reported under "warnings".
Requires a configured Telethon user session:
TELETHON_API_ID, TELETHON_API_HASH in ~/.hermes/.env (from my.telegram.org)
session file ~/.hermes/telethon/<name>.session
TELETHON_CHECKLIST_CHATS=-100... allowed chats/topics (comma-separated), optional
TELETHON_SESSION override the session file path, optional
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
state under "verified"; non-fatal issues are reported under "warnings".
Requires a configured Telethon user session:
TELETHON_API_ID, TELETHON_API_HASH in ~/.hermes/.env (from my.telegram.org)
session file ~/.hermes/telethon/<name>.session
TELETHON_CHECKLIST_CHATS=-100... allowed chats/topics (comma-separated), optional
TELETHON_SESSION override the session file path, optional
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
state under "verified"; non-fatal issues are reported under "warnings".
Requires a configured Telethon user session:
TELETHON_API_ID, TELETHON_API_HASH in ~/.hermes/.env (from my.telegram.org)
session file ~/.hermes/telethon/<name>.session
TELETHON_CHECKLIST_CHATS=-100... allowed chats/topics (comma-separated), optional
TELETHON_SESSION override the session file path, optional
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
state under "verified"; non-fatal issues are reported under "warnings".
Requires a configured Telethon user session:
TELETHON_API_ID, TELETHON_API_HASH in ~/.hermes/.env (from my.telegram.org)
session file ~/.hermes/telethon/<name>.session
TELETHON_CHECKLIST_CHATS=-100... allowed chats/topics (comma-separated), optional
TELETHON_SESSION override the session file path, optional
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
state under "verified"; non-fatal issues are reported under "warnings".
Requires a configured Telethon user session:
TELETHON_API_ID, TELETHON_API_HASH in ~/.hermes/.env (from my.telegram.org)
session file ~/.hermes/telethon/<name>.session
TELETHON_CHECKLIST_CHATS=-100... allowed chats/topics (comma-separated), optional
TELETHON_SESSION override the session file path, optional
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if v is None or (v == "" and not empty_wins):
if HERMES is None:
return None
return _load_env_file(HERMES / ".env").get(name)
return v
The skill uses sensitive capabilities (environment variables, local file access, and shell execution) but does not declare an explicit tool scope or permissions boundary. That creates a governance gap: an agent runtime may expose more capability than users or policy expect, increasing the chance of unintended credential access or command execution under the guise of a narrow Telegram checklist skill.
The skill depends on a persistent Telethon user session stored on disk and API credentials from the environment. Persistent authenticated sessions are sensitive artifacts; if the host, session file, or adjacent tooling is compromised, an attacker could act as the Telegram user within the allowlisted scope without re-authentication.
---
# Telegram Checklist (native To-Do lists via Telethon)
Create and maintain native Telegram checklist objects (checkboxes, progress counter, shared completion) from a Telethon user session. The Bot API `sendChecklist` works only on behalf of a business account into its private chats with customers - a bot cannot post a checklist into a group or forum topic. MTProto under a user session can, which is what this skill does. Creating a checklist requires Telegram Premium on the acting account; reading or completing one does not. Keep this skill separate from any read-only Telethon reader.
## Requirements (one-time)
- a configured Telethon user session: `TELETHON_API_ID` / `TELETHON_API_HASH` in `~/.hermes/.env` (from my.telegram.org), session file in `~/.hermes/telethon/` (default `user.session`; override with `TELETHON_SESSION`)
The module intentionally operates using a persistent Telegram user session, which means possession of the session file can grant ongoing account access without re-entering credentials. In an agent context, this materially increases blast radius: compromise of the host, workspace, or session path may let an attacker read or act as the Telegram user within the tool's allowed scope.
#!/usr/bin/env python3
"""telethon_checklist.py - native Telegram To-Do lists (checklists) via Telethon.
WRITE module for a Hermes agent: create / read / append / toggle native Telegram
To-Do lists (checkboxes, progress, shared completion) from a user session. The
Bot API cannot post these into groups or forum topics (sendChecklist works only
on behalf of a business account, into private chats); MTProto under a user
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Comma-separated entries: '-100123' (whole chat) or '-100123:33' (topic 33
only). Only negative chat ids (groups/channels) are accepted - user peers
stay out of scope for a WRITE tool. Topic ids start at 2: the General
topic (1) cannot be topic-restricted, allow the whole chat instead.
Saved Messages ('me') is always allowed. Bad entries produce a warning
that never echoes the raw value (it could be a mispasted secret).
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
def _lock_session():
"""Best-effort chmod 0600 on the ACTUAL session file. Telethon decides the
filename by STRING suffix (str.endswith('.session')), not pathlib .suffix -
so a file literally named '.session' is used as-is, not doubled. chmod only
a regular file (never a directory) and never let this raise."""
No suspicious patterns detected.