Spaces Group Assistant

• Outcome: Review
• Latest audit: May 28, 2026, 12:30 PM
• Version:
  0.1.2

Overview

This skill is transparent about being a Telegram group assistant, but it gives a whole group and private chats broad access to internal workspace data and possible execution workflows without per-user controls.

Install only if every member of the hard-coded Telegram group, and every user who can reach the bot in private chat, should be trusted with internal workspace memory, logs, reports, and any enabled tools. Before use, add per-user allowlists or role checks, restrict readable paths, keep group requests read-only by default, require confirmation for exec/hooks, redact secrets from logs and memory, and review group membership regularly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states that users in a Telegram group can access internal knowledge, memory, logs, and even exec/server-side hook capabilities from a shared chat. In a multi-user group context, this creates a strong risk of unauthorized disclosure of sensitive workspace data and potentially dangerous system-side actions, especially because the documentation does not present clear consent, authorization, or risk warnings.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The phrase indicating that 'any participant in the group' can obtain summaries and answers from internal markdown files and memory stores means sensitive information may be exposed to all members of a shared chat. Trusting an entire group as equivalent to an authorized individual is dangerous because group composition can change, accounts can be compromised, and users may not realize private data is being surfaced publicly to others.

VirusTotal

66/66 vendors flagged this skill as clean.