📤 Telegram File Sender

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:19 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it can send local files to Telegram with weak confirmation, destination visibility, and cleanup controls.

Review this before installing if your workspace may contain private files. Only use it for explicit file-send requests, verify the exact file and Telegram destination before each send, avoid relying on the documented prefix path check without a safer containment check, and do not let it delete /tmp/ files unless it created them during the same operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:95
• Finding: Workspace Boundary Bypass Through Unsafe String-Prefix Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 95 **Vulnerability Type**: Improper path containment validation **Risk Level**: High ### Vulnerable Code ```markdown 2. **Path traversal prevention:** Always resolve with `realpath` and verify the result starts with the workspace root. ``` The equivalent instruction is duplicated in the translated section at line 173. ### Technical Analysis The Skill instructs the agent to validate a canonical file path by checking whether it starts with the workspace root. A plain string-prefix comparison does not reliably prove that the file is inside the intended directory. For example, if the workspace root is `/work/app`, the path `/work/application/secret.pdf` starts with `/work/app` as a string but is not contained within that directory. Using `realpath` resolves `..` components and symbolic links, but it does not make an unsafe prefix comparison directory-boundary-aware. Because successful validation is followed by uploading the selected file to Telegram, this flaw can cross a local confidentiality boundary. ### Attack Path 1. Determine or infer the workspace root, such as `/work/app`. 2. Identify a sibling directory whose name begins with the same prefix, such as `/work/application`. 3. Request a file such as `/work/application/secret.pdf`. 4. The Skill resolves the path with `realpath`. 5. A naive check such as `candidate.startsWith(workspaceRoot)` returns true. 6. The out-of-workspace file is submitted to the Telegram Bot API. 7. The recipient obtains data that the workspace restriction was intended to protect. ### Impact Assessment A successful exploit can disclose any agent-readable file located under a path that shares the workspace root's textual prefix. The vulnerability does not itself grant additional operating-system privileges, but it can expose files accessible to the current agent account and transmit them to an external Telegram chat. The precise scope depends on filesystem ...[truncated 49 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Canonicalize both the workspace root and candidate path using `realpath`. 2. Use a directory-boundary-aware containment check rather than a raw prefix comparison. 3. Accept the candidate only when it is equal to the workspace root or begins with the canonical root followed by the platform's directory separator. 4. Prefer a platform-native relative-path or containment API where available. 5. Confirm that the candidate is a regular file and revalidate it immediately before upload to reduce time-of-check/time-of-use risk. 6. Open the validated file without following symbolic links where the platform supports that behavior. A safe conceptual check is: ```text candidate == root OR candidate starts with root + directory_separator ``` Tests should cover sibling paths such as `/work/application` when the allowed root is `/work/app`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: Telegram Bot Token Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66-74 **Vulnerability Type**: Sensitive credential exposure in process arguments **Risk Level**: Medium ### Vulnerable Code ```bash BOT_TOKEN="$TG_BOT_TOKEN" CHAT_ID="<target chat ID>" FILE_PATH="<resolved absolute path>" CAPTION="<optional description>" curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \ -F chat_id="$CHAT_ID" \ -F document=@"$FILE_PATH" \ -F caption="$CAPTION" ``` The same unsafe URL construction is also used for `sendPhoto` at line 80 and duplicated in the translated example at lines 153-158. ### Technical Analysis The Bot API requires the token in the request URL. Expanding `${BOT_TOKEN}` directly in the `curl` command causes the complete token-bearing URL to become part of curl's process argument vector. Depending on operating-system configuration, process arguments may be visible through process inspection interfaces, diagnostic tools, shell tracing, endpoint monitoring, crash reporting, or command telemetry. The statement that the token is not logged does not prevent these indirect disclosure channels. Possession of the token ordinarily permits authentication as the Telegram bot within the authorization scope assigned to that bot. ### Attack Path 1. The Skill reads `TG_BOT_TOKEN` and interpolates it into the API URL. 2. It launches `curl` with the full token-bearing URL as a command-line argument. 3. A local user, monitoring agent, diagnostic collector, or other process with sufficient visibility captures curl's argument vector while the request is running. 4. The observer extracts the token from the `/bot<TOKEN>/...` URL. 5. The token is reused to invoke Telegram Bot API methods as the affected bot. ### Impact Assessment An attacker who obtains the token can impersonate the bot and invoke API operations allowed to it, potentially including sending messages or files, retrieving pending updates, and disrupting legitimate update ...[truncated 195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid placing the token-bearing URL directly in the process argument vector. 2. Supply sensitive curl configuration through standard input or a protected temporary descriptor rather than ordinary command-line arguments. 3. Disable shell tracing before handling the token and ensure diagnostics redact Telegram Bot API URLs. 4. Restrict process-inspection permissions and access to execution telemetry. 5. Keep the token only in the environment or protected memory for the minimum necessary duration. 6. Rotate the bot token immediately if process arguments may already have been collected. 7. Ensure any temporary configuration containing the token is created with owner-only permissions and securely removed. The implementation should also suppress or sanitize error output that could reproduce the request URL. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:100
• Finding: Unscoped Deletion of Files Located Under the Temporary Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 100 **Vulnerability Type**: Unsafe temporary-file cleanup **Risk Level**: Medium ### Vulnerable Code ```markdown 7. **Ephemeral files:** If the file is in `/tmp/`, clean up after sending. ``` The equivalent instruction is duplicated in the translated section at line 178. ### Technical Analysis The cleanup rule applies to any transmitted file located under `/tmp/`. It does not require that the Skill created the file, that the file is dedicated to this operation, or that the user authorized its deletion. Temporary directories commonly contain files owned or consumed by other applications. A file's presence under `/tmp/` does not imply that it is disposable. Automatically deleting a user-selected or shared temporary file after transmission therefore creates an unsafe arbitrary-file deletion primitive within the current account's filesystem permissions. The instruction also lacks requirements for canonical-path validation during cleanup, ownership verification, race-resistant deletion, or symbolic-link handling at deletion time. ### Attack Path 1. A file already used by the user or another process exists under `/tmp/`. 2. The file is selected for transmission, either intentionally or through misleading input. 3. The Skill sends the file successfully. 4. The cleanup rule directs the agent to delete it solely because its path is under `/tmp/`. 5. The original user or process subsequently loses access to the file or fails when attempting to use it. If path validation and deletion are separated, filesystem races could further increase the risk unless the implementation revalidates the exact object before deletion. ### Impact Assessment The Skill can delete files writable by the agent account under `/tmp/`, including files it did not create. This may cause data loss, application failure, interrupted workflows, or denial of service for processes sharing the same account or writable tempor ...[truncated 134 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Delete only temporary files created by this Skill during the current invocation. 2. Track every Skill-created temporary file explicitly rather than inferring ownership from an `/tmp/` path. 3. Never delete a user-supplied file automatically, even when it is located under `/tmp/`. 4. Require explicit confirmation before deleting any file not created by the Skill. 5. Create private temporary directories with restrictive permissions and unpredictable names. 6. Before cleanup, verify the canonical path, file identity, ownership, and expected directory. 7. Use race-resistant filesystem operations and avoid following symbolic links during deletion. 8. Treat upload failure and upload success consistently: cleanup only Skill-owned artifacts according to a documented lifecycle policy. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text includes a broad catch-all phrase like 'any request to deliver a workspace file via Telegram,' which can cause the skill to activate on loosely related prompts and exfiltrate local files to an external service. In a file-sending skill, overbroad activation materially increases the chance of unintended transmission because the action is inherently high sensitivity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description does not prominently warn up front that it will transmit local files outside the workspace to Telegram, a third-party service. Without an explicit disclosure before use, users may not understand that invoking the skill causes external data transfer, increasing the risk of accidental data leakage.

External Transmission

Medium

• Category: Data Exfiltration

Content

FILE_PATH="<resolved absolute path>"
CAPTION="<optional description>"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \
  -F chat_id="$CHAT_ID" \
  -F document=@"$FILE_PATH" \
  -F caption="$CAPTION"

• Confidence: 97% confidence
• Finding: This code path explicitly uploads a local file to Telegram's external API. Even though external transmission is the intended function, it is still a real security-sensitive data exfiltration primitive: if the skill is triggered on the wrong file, wrong chat context, or without sufficiently informed consent, local workspace data can be disclosed externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

For photos:

```bash
curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendPhoto" \
  -F chat_id="$CHAT_ID" \
  -F photo=@"$FILE_PATH" \
  -F caption="$CAPTION"

• Confidence: 97% confidence
• Finding: The photo send variant also uploads a local file to Telegram, creating the same outbound exfiltration channel for images and similar media. Images often contain sensitive content or metadata, so direct transmission to an external service remains dangerous even if this is expected behavior.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. **No content logging:** Do not log file contents or read file contents for any purpose beyond sending.
4. **Size limit:** Enforce 50 MB maximum (Telegram Bot API limit for documents).
5. **User confirmation:** For files > 10 MB, warn the user about size before sending.
6. **Chat ID:** Use the `chat_id` from the session context. Never prompt the user for a chat ID.
7. **Ephemeral files:** If the file is in `/tmp/`, clean up after sending.

## Behavior Rules

• Confidence: 85% confidence
• Finding: The instruction to use chat_id from session context and never prompt the user reduces user visibility into the destination and allows the skill to make a sensitive routing decision implicitly. For an exfiltration-capable skill, hiding or assuming the recipient increases the risk of sending files to the wrong chat or to a destination the user did not intend.

External Transmission

Medium

• Category: Data Exfiltration

Content

FILE_PATH="<解析后的绝对路径>"
CAPTION="<可选描述>"

curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendDocument" \
  -F chat_id="$CHAT_ID" \
  -F document=@"$FILE_PATH" \
  -F caption="$CAPTION"

• Confidence: 97% confidence
• Finding: The duplicated document-upload example in the Chinese section confirms the skill's core behavior is external transmission of local files to Telegram. This is a true vulnerability in the sense of a powerful exfiltration capability whose safety depends entirely on strong invocation, consent, and destination controls.

Static analysis

No suspicious patterns detected.