Security audit
Telegram OpenAPI Skill
Security checks across malware telemetry and agentic risk
Overview
This skill is a coherent Telegram Bot API helper, but installing it gives an agent real bot access that can send messages, upload chosen files, manage webhooks, and store polled updates locally.
Install only for a bot you are comfortable letting an agent operate. Use a dedicated bot token with limited chat/channel permissions, confirm every send/upload/webhook change, verify local file paths before media or certificate uploads, and avoid writing polling logs to shared temp locations unless you control permissions and retention.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.