ClawHub
Back to skill

Security audit

Telegram cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Telegram CLI helper, but it grants broad account access and side-effecting message/group/contact actions without enough scoping or confirmation guidance.

Review before installing. Use this only for explicit Telegram tasks, pin and verify the npm package version where possible, avoid broad automation over private chats, confirm before sending/deleting/marking-read/managing groups or contacts, and logout when you no longer want the CLI session retained.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 2. Install globally: `npm install -g node-telegram-cli` ``` ### Technical Analysis The installation instruction retrieves the current registry-selected version of `node-telegram-cli` without pinning an exact version or verifying a package integrity hash. Because the package is installed globally, its executable and npm lifecycle scripts run with the installing user's permissions and become available system-wide for that user. The reviewed project contains only `SKILL.md`; it does not include the package implementation, a lockfile, a verified artifact hash, or vendored source. Consequently, the package's implementation—including its claimed OS Keychain credential storage—cannot be verified from the supplied artifact. The effective code may also change after this Skill has been reviewed. This is a supply-chain weakness rather than evidence that the currently published package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package publication process, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the Skill instruction and runs `npm install -g node-telegram-cli`. 4. npm resolves the mutable registry version and downloads the compromised package. 5. Malicious lifecycle scripts may execute during installation, or malicious behavior may execute when the `ntg` command is invoked. 6. The package runs with the user's privileges and may access data available to that account, including Telegram data or session material accessible through the CLI. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user performing the installation or running the CLI. ...[truncated 742 chars]
Remediation
## Remediation Suggestions 1. Pin the dependency to an exact, security-reviewed version rather than relying on the registry's current release: ```bash npm install -g node-telegram-cli@<reviewed-exact-version> ``` 2. Record and verify the expected package artifact integrity hash before installation. 3. Include a lockfile, vendored source, or reproducibly built artifact so reviewers can inspect the implementation executed by the Skill. 4. Prefer a project-local installation over a global installation to reduce scope and improve dependency reproducibility. 5. Disable npm lifecycle scripts during installation with `--ignore-scripts` if the reviewed package does not require them. 6. Verify npm provenance and publisher identity as part of installation, rather than merely documenting that provenance exists. 7. Run the CLI under a dedicated, least-privileged operating-system account and restrict access to Telegram session material and downloaded media. 8. Document a tested version-upgrade procedure requiring source review, integrity verification, and security testing before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description is broadly scoped to 'any Telegram account interaction,' which can cause the agent to invoke this skill for a wide range of Telegram-related requests without sufficient narrowing to user intent or safety constraints. Because the tool includes message sending, deletion, group management, downloads, and contact changes, over-broad activation increases the chance of unnecessary access to private communications or unintended side-effecting actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This section documents commands that can send messages, forward content, mark messages read, delete messages, modify groups, download media, and open files, but it does not state that these actions require explicit user authorization or confirmation. In an agent setting, that omission is dangerous because the skill may normalize privacy-impacting and destructive operations, enabling accidental data exfiltration, account changes, or irreversible message/state changes.

Static analysis

No suspicious patterns detected.