ClawHub
Back to skill

Security audit

Telegram MTPROTO CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is aligned with reading Telegram data, but it needs Review because it installs an unpinned global third-party CLI that handles Telegram credentials, session keys, and private messages.

Before installing, verify the `tg-mtproto-cli` package and source, prefer a pinned or isolated install, and use an account and environment where exposing Telegram sessions, messages, and downloaded media would have acceptable impact.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12 and 45
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippets:

yaml
required_binaries:
  - name: tg
    package: tg-mtproto-cli
    install: npm install -g tg-mtproto-cli
    registry: https://www.npmjs.com/package/tg-mtproto-cli
    source: https://github.com/cyberash-dev/tg-mtproto-cli
markdown
| `tg` | `npm install -g tg-mtproto-cli` | Core CLI |

Technical Analysis

The Skill instructs users to install the mutable latest release of tg-mtproto-cli globally from npm without pinning an exact version or integrity digest. npm installation can execute package lifecycle scripts with the invoking user's privileges. Referencing a GitHub repository does not cryptographically establish that the npm artifact corresponds to reviewed source.

This dependency handles particularly sensitive resources: Telegram API credentials, system-keychain data, session databases containing authorization keys, private messages, and downloaded media. No evidence in SKILL.md indicates that the package is presently malicious, but the installation method leaves users exposed to a future malicious release or compromise of the publisher or registry account.

The separately flagged outbound Telegram traffic is necessary for the declared MTProto functionality. The audited file does not direct credentials or session material to an unrelated endpoint, and it explicitly warns against exposing session files. The confirmed concern is therefore the unsafe dependency-installation model rather than demonstrated credential exfiltration.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution process, or another relevant supply-chain component.
  2. The attacker publishes a malicious release under the existing tg-mtproto-cli package name.
  3. A user follows the Skill instruction `npm insta ...[truncated 1414 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin tg-mtproto-cli to an exact reviewed version rather than installing the mutable latest release.
  2. Enforce package integrity using a lockfile and registry integrity digest. Record the reviewed package version and checksum in the Skill documentation.
  3. Prefer a project-local installation or an isolated execution environment over npm install -g.
  4. Disable npm lifecycle scripts during installation where compatible, and separately review any scripts required by the package.
  5. Verify that the published npm tarball corresponds to the referenced source revision through reproducible builds, signed releases, provenance attestations, or documented checksum verification.
  6. Review updates before changing the pinned version, focusing on keychain access, session-file handling, filesystem operations, and network destinations.
  7. Restrict outbound traffic to documented Telegram infrastructure where operationally feasible, and monitor for connections to unrelated destinations.
  8. Run the CLI as an unprivileged user and limit filesystem and keychain access to the resources required for its declared Telegram functionality.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
| Resource | Access | Details |
|---|---|---|
| Network | Outbound TCP to Telegram DC servers | MTProto protocol, required for all commands |
| Session files | Read/write `~/.tg-mtproto-cli/sessions/*.session` | SQLite databases with auth keys; created by `tg auth` |
| System keychain | Read/write | Stores `api_id`, `api_hash`, account metadata, default account |
| Filesystem | Write (only `tg download`) | Saves media to `--out` dir or current directory |

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
## Guardrails

- The CLI is **read-only by design** — it has no commands to send messages, create chats, modify groups, or perform any write operations on Telegram. The only write targets are local: session files and downloaded media.
- `tg download` writes files only to the explicitly specified `--out` directory or cwd.
- Session files contain sensitive auth material — do not read, copy, or expose `~/.tg-mtproto-cli/sessions/` contents.
- Do not log or display `api_id` / `api_hash` values.

Static analysis

No suspicious patterns detected.