Telegram Channel Reader

• Outcome: Pass
• Latest audit: Jul 3, 2026 · 3:21 PM UTC
• Version: 0.11.1

Overview

This is a disclosed Telegram reader that needs a powerful local Telegram session, so the main risk is normal account/session exposure rather than hidden malicious behavior.

Install only if you want an agent on this machine to read Telegram channels accessible to your account. Treat ~/.tg-reader.json, *.session, session backups, saved outputs, and unread-state files as sensitive; avoid syncing or committing them, use 0600 permissions, and do not enable cron or TG_AUTH_PROGRESS unless you choose private paths and understand what will be stored.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'progress' from os.environ.get (line 693, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

progress = os.environ.get("TG_AUTH_PROGRESS")
    if progress:
        try:
            with open(progress, "a") as f:
                f.write(line + "\n")
        except OSError:
            pass

• Confidence: 83% confidence
• Finding: with open(progress, "a") as f:

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This skill goes beyond passive channel reading and includes full Telegram account onboarding, code handling, 2FA handling, session swapping, backup, and restoration. In a security-sensitive agent ecosystem, that materially increases the blast radius: the skill can establish and maintain a long-lived authenticated Telegram session, exposing account access and secrets to misuse if the skill is invoked unexpectedly, wrapped by other tools, or combined with prompt-injection/social-engineering flows.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill persists phone numbers and modifies local config state, which is sensitive credential-adjacent information, despite being presented primarily as a channel reader. In agent environments, unexpected state mutation can leak personal identifiers, weaken operator expectations about what the tool stores, and make later unauthorized reauthentication easier.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill encourages saving fetched channel data to local files for token savings, but this output can contain sensitive or private Telegram content, especially for private channels or comments. Without an explicit warning about local retention, file permissions, and cleanup, users or downstream automations may persist sensitive data longer than intended.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The guidance to save summaries and tracked channel lists in local files omits privacy considerations, even though summaries may contain sensitive content and tracked channel lists may reveal user interests or memberships. While less severe than session leakage, this still creates avoidable data-retention risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Human-readable output
tg-reader fetch @channel_name --since 24h --format text

# Write output to file instead of stdout (saves tokens)
tg-reader fetch @channel_name --since 24h --output
tg-reader fetch @channel_name --since 24h --comments --output comments.json

• Confidence: 76% confidence
• Finding: Write output to file instead of stdout (saves tokens) tg-reader fetch @channel_name --since 24h --output tg-reader fetch @channel_name --since 24h --comments --output comments.json # Use Telethon ins

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 1 — Get API Credentials

Go to https://my.telegram.org → **API Development Tools** → create an app → copy `api_id` and `api_hash`.

### Step 2 — Save Credentials

• Confidence: 89% confidence
• Finding: create an app → copy `api_id` and `api_hash`. ### Step 2 — Save Credentials **Recommended** (works in agents and servers): ```bash cat > ~/.tg-reader.json << 'EOF' { "api_id": YOUR_ID, "api_hash

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.