Telegram MTPROTO CLI

• Outcome: Pass
• Latest audit: May 28, 2026 · 6:47 AM UTC
• Version: 0.1.4

Overview

This skill appears to be a disclosed, read-only Telegram CLI integration, with sensitive credential and session handling that users should protect carefully.

Install only if you are comfortable giving this CLI access to your Telegram account, local Telegram session database, and system keychain entries. Keep the session directory private, do not share session files, and use it only on a machine where you trust the local agent/runtime with Telegram message access.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

filesystem:
    - read/write: ~/.tg-mtproto-cli/sessions/*.session (SQLite auth sessions)
    - write: media files to --out dir or cwd (tg download only)
  keychain: read/write account metadata and API credentials
  shell: false
  browser: false
---

• Confidence: 72% confidence
• Finding: The skill explicitly grants read/write access to both Telegram session files and the system keychain, which contain reusable authentication material and API credentials. Even though the skill presents this as necessary runtime behavior, any agent granted these capabilities could expose or misuse long-lived credentials if the surrounding execution environment is compromised or the skill is invoked unsafely.

Credential Access

High

• Category: Privilege Escalation

Content

|---|---|---|
| Network | Outbound TCP to Telegram DC servers | MTProto protocol, required for all commands |
| Session files | Read/write `~/.tg-mtproto-cli/sessions/*.session` | SQLite databases with auth keys; created by `tg auth` |
| System keychain | Read/write | Stores `api_id`, `api_hash`, account metadata, default account |
| Filesystem | Write (only `tg download`) | Saves media to `--out` dir or current directory |

## Guardrails

• Confidence: 74% confidence
• Finding: This section confirms that the tool stores sensitive Telegram auth keys in local SQLite session files and maintains API credentials in the system keychain. Those artifacts are high-value secrets because they can enable continued access to Telegram data, so documenting persistent read/write access to them reflects a real attack surface even if the tool itself is intended to be read-only with respect to Telegram content.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Resource | Access | Details |
|---|---|---|
| Network | Outbound TCP to Telegram DC servers | MTProto protocol, required for all commands |
| Session files | Read/write `~/.tg-mtproto-cli/sessions/*.session` | SQLite databases with auth keys; created by `tg auth` |
| System keychain | Read/write | Stores `api_id`, `api_hash`, account metadata, default account |
| Filesystem | Write (only `tg download`) | Saves media to `--out` dir or current directory |

• Confidence: 80% confidence
• Finding: Persistent session storage in `~/.tg-mtproto-cli/sessions/*.session` creates durable local authentication state that can survive beyond a single task. If those SQLite session files are copied, read, or exfiltrated, an attacker may be able to reuse Telegram auth state to access message history and media without repeating the full login flow.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.