Telegram OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 1.0.1

Overview

This Telegram bot skill is mostly coherent, but it needs Review because it combines bot write authority, local file uploads, webhook changes, and background polling with a few under-scoped safety details.

Install only if you are comfortable giving the skill control over a Telegram bot token, sending messages/media, uploading explicitly provided local files, and changing webhook state. Prefer using the bundled schema or a pinned schema URL, store polling output in a private per-user directory with restrictive permissions, and require explicit confirmation before sends, local uploads, webhook changes, or dropping pending updates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/usage-patterns.md:48
• Finding: Telegram Updates Are Written to a Predictable Shared Temporary File## Vulnerability Details **File Location**: `SKILL.md:83`; `references/usage-patterns.md:48-54` **Vulnerability Type**: Unsafe temporary-file handling and plaintext storage of sensitive Telegram data **Risk Level**: Medium **Complete Vulnerable Code Snippet**: ```bash # Run background polling through uxc subscribe with offset derived from update_id + 1 # Only one getUpdates consumer can be active for the bot token at a time. uxc subscribe start https://api.telegram.org post:/getUpdates \ '{"timeout":5,"allowed_updates":["message","callback_query"]}' \ --mode poll \ --poll-config '{"interval_secs":2,"extract_items_pointer":"/result","request_cursor_arg":"offset","cursor_from_item_pointer":"/update_id","cursor_transform":"increment","checkpoint_strategy":{"type":"item_key","item_key_pointer":"/update_id"}}' \ --sink file:/tmp/telegram-updates.ndjson ``` The same unsafe sink is presented in `SKILL.md:83`: ```bash uxc subscribe start https://api.telegram.org post:/getUpdates '{"timeout":5,"allowed_updates":["message","callback_query"]}' --mode poll --poll-config '{"interval_secs":2,"extract_items_pointer":"/result","request_cursor_arg":"offset","cursor_from_item_pointer":"/update_id","cursor_transform":"increment","checkpoint_strategy":{"type":"item_key","item_key_pointer":"/update_id"}}' --sink file:/tmp/telegram-updates.ndjson ``` ### Technical Analysis Telegram updates may contain private message text, chat and user identifiers, usernames, callback-query data, and other bot-visible metadata. The documented polling workflow persists all emitted updates to the fixed path `/tmp/telegram-updates.ndjson`. A globally predictable path in a shared temporary directory is unsafe unless the consumer creates the file atomically, rejects symbolic links, verifies ownership, and applies restrictive permissions. Neither the Skill nor its usage guide establishes a restrictive `umask`, creates a private directory, validates an ...[truncated 1791 chars]
• Remediation: ## Remediation Suggestions - Do not use a fixed filename directly under `/tmp`. - Create a private, per-run directory and restrictive permissions before starting the sink: ```bash umask 077 TELEGRAM_SINK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/telegram-updates.XXXXXX")" TELEGRAM_SINK="${TELEGRAM_SINK_DIR}/updates.ndjson" ``` - Pass `file:${TELEGRAM_SINK}` as the sink only after confirming that the path does not already exist and that its parent directory is owned by the current user. - Ensure the sink creates the destination atomically with mode `0600`, refuses symbolic links, and does not silently append to an attacker-created file. - Prefer an application-private state directory outside a shared temporary directory for long-running subscriptions. - Document retention limits and secure cleanup procedures for update records. - Warn users that Telegram updates may contain personal or confidential information and should not be logged unless persistence is explicitly required.

T08 · Insecure Dependencies

Note

• Location: references/usage-patterns.md:4
• Finding: Mutable Remote OpenAPI Schema Is Used Without Integrity Pinning## Vulnerability Details **File Location**: `SKILL.md:15-16,59-61,147`; `references/usage-patterns.md:4-9` **Vulnerability Type**: Unpinned remote dependency and supply-chain risk **Risk Level**: Low **Complete Vulnerable Code Snippet**: ```bash command -v telegram-openapi-cli uxc link telegram-openapi-cli https://api.telegram.org \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/telegram-openapi-skill/references/telegram-bot.openapi.json telegram-openapi-cli -h ``` The same mutable source is required by the core workflow in `SKILL.md:59-61`: ```bash command -v telegram-openapi-cli # If missing, create it: uxc link telegram-openapi-cli https://api.telegram.org --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/telegram-openapi-skill/references/telegram-bot.openapi.json ``` ### Technical Analysis The setup instructions retrieve the OpenAPI schema from the `main` branch of an external GitHub repository. A branch reference is mutable: its content may change after this Skill has been reviewed. The instructions do not pin a commit, verify a cryptographic digest, or compare the downloaded schema with the bundled `references/telegram-bot.openapi.json`. The schema controls which Telegram operations and request parameters are exposed through the generated CLI. Although it is data rather than a directly executed script, an unauthorized or unexpected schema change can alter requests made under the configured bot credential. This creates a supply-chain trust gap between the audited package and its runtime behavior. Network retrieval is necessary only if the bundled schema cannot be used. Retrieving a mutable copy on every setup exceeds the minimum dependency risk necessary for the declared functionality because the project already includes a curated local schema. ### Attack Path 1. An attacker compromises the upstream repository, an authorized maintainer account, or anothe ...[truncated 1522 chars]
• Remediation: ## Remediation Suggestions - Prefer the bundled and audited `references/telegram-bot.openapi.json` rather than downloading a runtime copy. - If remote retrieval is required, pin the URL to a reviewed immutable commit instead of `main`. - Publish and verify a SHA-256 digest before passing the schema to `uxc`. - Fail closed when the retrieved schema does not match the expected digest. - Review schema updates through the same security process as Skill code changes. - Document the exact trusted repository, commit identifier, and expected digest. - Consider restricting accepted schema servers and operations so a schema change cannot broaden the host or API surface silently.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation gives conflicting guidance about media upload support: one line says sendPhoto/sendDocument/sendMediaGroup do not upload local files, while the next says sendPhoto and sendDocument do support multipart local uploads. In a security-sensitive automation skill, this ambiguity can cause an agent or operator to choose an unintended transfer mode and exfiltrate local files to Telegram when they believed only file_id or URL inputs were allowed.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This JSON manifest defines a destructive operation, /deleteWebhook, and references DeleteWebhookRequest with a drop_pending_updates option, but provides no user-facing warning that queued updates may be discarded. For manifest files, SQP-1 applies here because the invocation surface is underspecified and lacks explicit caution around a potentially irreversible trigger path.

External Transmission

Medium

• Category: Data Exfiltration

Content

--credential telegram-bot \
  --priority 100

uxc auth binding match https://api.telegram.org/getMe
```

## Read Examples

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

--credential telegram-bot \
  --priority 100

uxc auth binding match https://api.telegram.org/getMe
```

## Read Examples

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

--credential telegram-bot \
  --priority 100

uxc auth binding match https://api.telegram.org/getMe
```

## Read Examples

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

--credential telegram-bot \
  --priority 100

uxc auth binding match https://api.telegram.org/getMe
```

## Read Examples

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: The manifest describes photo upload via a 'Local file path to upload as the photo body' but does not specify limitations, safe path expectations, or exclusion examples. In a manifest file, this broad natural-language trigger/usage description can lead to ambiguous invocation of local-file access behavior.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: The schema allows a 'Local file path to upload as the document body' but does not narrow when that behavior should be invoked or what files are in scope. For manifest files, vague or unconstrained descriptions of local-file actions can cause unintended broad activation.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The multipart webhook schema states that certificate is a 'Local PEM certificate file path' but does not define boundaries, exclusions, or examples for safe use. In manifest files, this is an underspecified activation/usage condition for local file access.

Static analysis

No suspicious patterns detected.