Telegram File Browser

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 0.1.1

Overview

This is a real Telegram file browser, but it can send local files to chat and treats callback-looking text messages as commands without strong session checks.

Install only if you are comfortable exposing files from the chosen browser root to Telegram. Keep the root limited to a non-sensitive workspace, avoid browsing home or system directories, and do not use this in shared chats unless callback handling is bound to the intended user/session or downloads require confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute local Python scripts, read and write persistent state, and interact with filesystem paths, yet the skill metadata declares no permissions. This creates a trust-boundary mismatch: an orchestrator or reviewer may treat the skill as low-privilege while it actually performs shell execution and filesystem operations, increasing the chance of unintended file access or command execution in sensitive contexts.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill can send arbitrary local files via the 'download' action, which exceeds the stated browsing/preview/path exposure scope and creates a direct data-exfiltration path. In a Telegram-integrated file browser, this is especially sensitive because a callback can cause server-side files to be transmitted out of the host environment to a chat recipient.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guidance explicitly recommends sending local files as Telegram attachments from a browser rooted at local workspace paths, but does not require authorization checks, path restrictions beyond the chosen root, file-type safeguards, or user-facing privacy warnings. In this skill context, that omission is security-relevant because the feature is designed to expose and transmit local filesystem contents through chat, which can lead to accidental disclosure of sensitive files or secrets if implemented naively.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- if inbound text matches `^tfb_(root|dir|preview|path|download|back|close)_`
- treat it as a telegram-file-browser callback
- run `browser_dispatcher.py handle-callback <that_text>` immediately
- do not ask the user what they mean

---

• Confidence: 90% confidence
• Finding: do not ask the user

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.