Security audit

Spaces Group Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly built for a trusted Telegram assistant, but it grants broad workspace, memory, logs, and possible exec access to all users in one group and any private chat without user-level authorization.

Install only if every member of the configured Telegram group and every person who can privately message the bot is trusted with workspace memory, logs, internal documents, and any enabled execution hooks. Before broader use, add explicit user allowlists, per-tool authorization, and tool-level calendar blocking instead of keyword filtering.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: spaces-group-assistant.js:13
Finding: Private-chat type is treated as authorization for full workspace access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: spaces-group-assistant.js:6
Finding: Calendar access control can be bypassed through keyword evasion
Content: View full analysis
lc.includes(key)); } ``` ```javascript // Блокируем календарь везде, кроме приватного чата if (isCalendarQuery(text)) { if (!is_private) { return {text: "⛔️ Календарь доступен только в приватном чате. Обратись ко мне лично для информации о встречах или напоминаниях."}; } // В личке — ОК return null; } // Полный доступ — групповой ассистент для указанного chat_id и лички if (FULL_POWER_GROUPS.has(chat_id) || is_private) { // Нет фильтра по user — реагируем на всех (group assistant mode) return null; // Пусть ядро обработает как обычный ассистент (workspace, KB, memory, логи и т.д.) ``` The associated denylist is: ```javascript const CALENDAR_KEYWORDS = ["календар", "calendar", "встреч", "meeting", "gcalcli", "расписание"]; ``` ### Technical Analysis Calendar confidentiality is enforced only by searching the raw lowercased message for six substrings. This is not a reliable authorization boundary because the same intent can be expressed without any listed token. Bypass variants include synonyms, paraphrases, typographical changes, Unicode substitutions, inserted separators, or indirect requests. Examples include asking for “tomorrow's appointments,” “my agenda,” or “the events planned for Friday.” None of those English phrases necessarily contains a configured keyword. When the text does not match the denylist, a request from the hardcoded privileged group reaches the general full-access branch. The function returns `null`, permitting the downstream assistant to interpret the semantic intent and potentially invoke calendar capabilities. Thus, the natural-language model ...[truncated 1505 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description explicitly grants trusted-group users broad access to workspace markdown, memory, logs, analytics, and even exec/server-side hooks, which materially expands the attack surface. In a group chat, any compromised member account, malicious insider, or prompt-injection through shared context could trigger disclosure of sensitive local data or dangerous server-side actions.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment on L01 says the skill answers all requests in the special group but 'calendar blocks'. However, the implementation only blocks calendar-related queries in non-private chats and explicitly permits them in private chat by returning null on L22-L23. This is an active contradiction between the documented behavior and the actual logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: In the allowed special group, the skill intentionally processes messages from any user and passes them to the core assistant, which may expose workspace knowledge, memory, logs, or other assistant capabilities to all group participants without per-user authorization or an explicit notice. In a group setting, this can lead to unintended disclosure of sensitive organizational context or processing of messages from untrusted users who happen to be present in that chat.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language instructions and examples are predominantly in Russian, and the file does not indicate that users can choose another language or that the skill is intentionally limited to a Russian-speaking audience. This can be a language/locale policy issue under the rule requiring opt-in or clear justification for enforced language constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language comment says the assistant 'отвечает на все обращения в спецгруппе', and all user-facing responses in the file are written only in Russian. The file does not offer a language choice or explain that the skill is intentionally limited to a Russian-speaking context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.