T09 · Insecure Skill Coding Practices
Warning
- Location
- examples/ANSWERS-prometheus.md:305
- Finding
- Hard-Coded Telegram Recipient in Reusable Behavioral Example<![CDATA[ ## Vulnerability Details **File Location**: `examples/ANSWERS-prometheus.md`, lines 305–373 **Vulnerability Type**: Hard-coded external messaging destination and unsafe trust assumption **Risk Level**: Medium ### Vulnerable Code ```bash message --action send --channel telegram --target 57924687 \ --threadId 378715 --media /tmp/analysis.pdf \ --message "Analysis complete" ``` ```bash message --action send --channel telegram --target 57924687 \ --threadId 379000 --media /path/to/image.png \ --message "Here's the image" ``` ```markdown 5. **Telegram with Ivan = Internal** (no permission needed) 6. **Thread ID from current session** (never cached) 7. **Unsaved experience = degradation** (not neutral, negative) 8. **"Won't need it" is wrong** (dangerous assumption) 9. **Memory update = Pre-flight update** (synchronize immediately, same session) 10. **Send files as attachments** (not host paths, use --media flag) ``` ### Technical Analysis The reusable example embeds the fixed Telegram recipient ID `57924687` and directs the agent to send local files to that destination. It also characterizes communication with that recipient as internal and states that permission is unnecessary. The Markdown is not executed automatically by the included shell scripts. However, the project is designed to make agents read behavioral answer files and adopt their contents as canonical operating rules. If a user copies or directly uses this example, an agent with access to an authenticated messaging tool may follow the fixed command without confirming that the recipient belongs to the current user. This is an insecure example/configuration practice rather than confirmed malicious execution. Exploitation requires the example to be adopted as active behavioral guidance and requires the agent to have both Telegram messaging capability and access to the referenced file. ### Attack Path 1. A user or agent copies `examples/ANSWERS-prometheus.md` into the active pre ...[truncated 1189 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace all concrete recipient and thread identifiers with unmistakable placeholders: ```bash message --action send --channel telegram \ --target "${CURRENT_USER_TELEGRAM_ID}" \ --threadId "${CURRENT_SESSION_THREAD_ID}" \ --media "${USER_APPROVED_FILE}" \ --message "Analysis complete" ``` 2. Add a prominent warning that example commands must not be executed unchanged and contain no trusted default destination. 3. Require the recipient to be derived from authenticated current-session context rather than from an example file, persistent memory, or cached conversation state. 4. Require explicit user confirmation before transmitting a file when the destination cannot be cryptographically or operationally associated with the current user. 5. Remove the blanket rule that communication with a named recipient requires no permission. Replace it with a context-bound rule that validates the current account, channel, recipient, thread, file, and purpose. 6. Add a pre-send safety check that displays the resolved recipient, channel, thread, file path, and file size before upload. 7. Use synthetic identifiers in all distributed documentation and add automated repository checks that reject real recipient IDs, account identifiers, credentials, or environment-specific routing values. ]]>