Telegram cli

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:19 PM UTC
• Version: 1.0.5

Overview

The skill is a coherent Telegram CLI helper, but it grants broad account access and side-effecting message/group/contact actions without enough scoping or confirmation guidance.

Review before installing. Use this only for explicit Telegram tasks, pin and verify the npm package version where possible, avoid broad automation over private chats, confirm before sending/deleting/marking-read/managing groups or contacts, and logout when you no longer want the CLI session retained.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown

2. Install globally: `npm install -g node-telegram-cli`

Technical Analysis

The installation instruction retrieves the current registry-selected version of node-telegram-cli without pinning an exact version or verifying a package integrity hash. Because the package is installed globally, its executable and npm lifecycle scripts run with the installing user's permissions and become available system-wide for that user.

The reviewed project contains only SKILL.md; it does not include the package implementation, a lockfile, a verified artifact hash, or vendored source. Consequently, the package's implementation—including its claimed OS Keychain credential storage—cannot be verified from the supplied artifact. The effective code may also change after this Skill has been reviewed.

This is a supply-chain weakness rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, package publication process, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the Skill instruction and runs npm install -g node-telegram-cli.
4. npm resolves the mutable registry version and downloads the compromised package.
5. Malicious lifecycle scripts may execute during installation, or malicious behavior may execute when the ntg command is invoked.
6. The package runs with the user's privileges and may access data available to that account, including Telegram data or session material accessible through the CLI.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user performing the installation or running the CLI. ...[truncated 742 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, security-reviewed version rather than relying on the registry's current release:

   bash

   npm install -g node-telegram-cli@<reviewed-exact-version>
   

2. Record and verify the expected package artifact integrity hash before installation.
3. Include a lockfile, vendored source, or reproducibly built artifact so reviewers can inspect the implementation executed by the Skill.
4. Prefer a project-local installation over a global installation to reduce scope and improve dependency reproducibility.
5. Disable npm lifecycle scripts during installation with --ignore-scripts if the reviewed package does not require them.
6. Verify npm provenance and publisher identity as part of installation, rather than merely documenting that provenance exists.
7. Run the CLI under a dedicated, least-privileged operating-system account and restrict access to Telegram session material and downloaded media.
8. Document a tested version-upgrade procedure requiring source review, integrity verification, and security testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broadly scoped to 'any Telegram account interaction,' which can cause the agent to invoke this skill for a wide range of Telegram-related requests without sufficient narrowing to user intent or safety constraints. Because the tool includes message sending, deletion, group management, downloads, and contact changes, over-broad activation increases the chance of unnecessary access to private communications or unintended side-effecting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section documents commands that can send messages, forward content, mark messages read, delete messages, modify groups, download media, and open files, but it does not state that these actions require explicit user authorization or confirmation. In an agent setting, that omission is dangerous because the skill may normalize privacy-impacting and destructive operations, enabling accidental data exfiltration, account changes, or irreversible message/state changes.

Content

No source excerpt is available for this finding.