Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it is a privacy-sensitive Telegram lookup tool that encourages checking phone numbers without clear consent or authorization limits.
Install only if you have a legitimate reason to check the phone numbers involved and can obtain consent or authorization where required. Expect phone numbers and returned Telegram profile data to be sent to apipick; avoid using it for broad enumeration, stalking, profiling, or storing raw lookup results unnecessarily. Protect the APIPICK_API_KEY like any other credential.
The skill explicitly promotes checking whether someone uses Telegram and finding a Telegram username by phone number without any consent, ownership, or lawful-use restriction. This enables account enumeration and privacy-invasive lookups of third parties, which can support stalking, harassment, social engineering, or doxxing.
The README explicitly markets checking whether arbitrary phone numbers are registered on Telegram and retrieving associated profile data through a third-party API, but it provides no warning about consent, lawful basis, or privacy obligations. This enables misuse for enumeration, stalking, doxxing, or unauthorized profiling of third parties, and the skill context makes the issue more dangerous because the primary advertised use is inspecting someone else's phone number rather than managing the caller's own account.
The skill sends a phone number to a third-party service and returns account/profile data, but it does not warn users that sensitive personal data is being transmitted off-platform. This creates a privacy and consent risk because users may unknowingly submit another person's phone number and receive identifying Telegram information from an external API.
The API reference documents sending a phone number to a third-party service and receiving account/profile data, but it does not warn users about the privacy implications, consent requirements, or sensitivity of the returned identifiers and names. In this skill’s context, the omission is more dangerous because the stated use cases include checking whether someone uses Telegram and finding a username by phone number, which can facilitate privacy-invasive enumeration and doxxing without adequate user awareness.
The example explicitly transmits a phone number and API key to an external service, which is a real external data transfer. In this skill’s context, that transfer is the core function, but it is still security-relevant because the data includes a personal identifier and may return additional personal profile information; without clear disclosure and handling guidance, users may unknowingly expose sensitive data to a third party.
curl -X POST https://www.apipick.com/api/check-phone-telegram \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{"phone_number": "+1234567890"}'
No suspicious patterns detected.