emoji and tg stickers use proactively based on mood

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:17 AM UTC
• Version: 3.0.0

Overview

This skill appears intended to send Telegram stickers, but it gives the agent broad autonomous posting authority and includes a reported code-injection risk in its helper script.

Review this carefully before installing. Only use it if you are comfortable granting a Telegram bot the ability to post stickers on your behalf, and prefer enabling it only for specific chats with explicit opt-in. The maintainer should narrow activation rules, document Telegram and shell permissions, add rate limits and opt-out controls, and fix the reported emoji handling vulnerability before broad use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes a shell script to send Telegram stickers, but no explicit permissions are declared for outbound messaging or shell execution. This creates a hidden capability boundary: a user or platform may believe the skill is harmlessly decorative while it can execute commands and perform unsolicited external actions. In this context, the mismatch is more dangerous because the skill is designed to trigger broadly and act autonomously on nearly every Telegram message.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill description promises simple mood-matching sticker and emoji behavior, but the documented behavior also includes enumerating sticker set contents and caching file IDs, which expands data access and operational scope beyond the user-facing description. Misdescribed behavior undermines informed consent and review, especially when combined with autonomous outbound messaging. The danger is elevated here because the skill presents itself as lightweight chat enhancement while embedding additional discovery and command-driven behaviors.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The script exposes a generic `--list-set` capability that can enumerate arbitrary Telegram sticker sets, which exceeds the narrow stated purpose of automatically sending mood-matching reactions in conversation. While sticker-set metadata is not highly sensitive by itself, this broadens the skill into a general discovery tool and increases the available external interaction surface beyond what is necessary.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The activation model is overly broad: it says to use the skill on every Telegram message. That means unsolicited outbound actions can occur across essentially all conversations, increasing the chance of privacy violations, spammy behavior, and interference in serious or sensitive chats. In context, broad triggering is especially risky because the skill is autonomous and message-sending rather than purely advisory.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill relies on vague mood judgments like 'you feel it' and 'trust your instinct,' which makes triggering subjective and hard to audit. Ambiguous criteria increase the likelihood of inappropriate autonomous actions, including sending stickers in contexts where users do not expect or want them. This is more dangerous here because the output is an external side effect sent to third-party chats, not just internal reasoning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells the agent to send messages on its own without asking the user first, but it does not provide a clear user-facing warning or consent flow for unsolicited outbound actions. This can cause unauthorized communications, embarrassment, spam, and trust erosion. The context makes it more dangerous because Telegram messages are user-visible external actions and the skill is optimized to send them proactively and frequently.

External Transmission

Medium

• Category: Data Exfiltration

Content

send_sticker_by_id() {
  local chat_id="$1" file_id="$2"
  curl -s -X POST "${API}/sendSticker" \
    -d chat_id="${chat_id}" \
    -d sticker="${file_id}"
}

• Confidence: 95% confidence
• Finding: curl -s -X POST "${API}/sendSticker" \ -d chat_id="${chat_id}" \ -d sticker="${file_id}" } get_sticker_set() { local set_name="$1" curl -s -X POST "${API}/getStickerSet" \ -d

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: telegram-sticker-vibes
description: Automatically send Telegram stickers and emojis that match the mood and vibe of the conversation. Activates on every Telegram message to add expressive, human-like sticker and emoji reactions without being asked. Use this skill whenever you are chatting on Telegram to make conversations feel alive and fun.
metadata:
  openclaw:
    emoji: "🎭"

• Confidence: 86% confidence
• Finding: Automatically send

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.