Tgsearch Telethon

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:57 AM UTC
• Version: 0.1.1

Overview

The skill is a disclosed Telegram search wrapper, but it relies on an unreviewed local executable with access to an authorized Telegram session.

Install only in an environment where you trust and can verify /usr/local/bin/tg_search and the Telegram account/session it uses. Prefer a narrowly scoped Telegram account, confirm the binary's owner and permissions, and enforce the documented limit before use.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

• Location: run.py:12

Finding

Unverified External Executable Controls the Skill's Effective Behavior

Content

View full analysis

Vulnerability Details

File Location: run.py, lines 12–17
Vulnerability Type: Untrusted external tool execution
Risk Level: Medium

Vulnerable Code

python

p = subprocess.run(
    ["/usr/local/bin/tg_search", query, limit],
    capture_output=True,
    text=True
)

Technical Analysis

The skill delegates all substantive Telegram search behavior to /usr/local/bin/tg_search, an executable located outside the reviewed project. The package does not bundle this executable, verify its cryptographic digest, validate its ownership or permissions, or otherwise confirm that it implements the documented behavior.

Using an absolute path and passing arguments as an array prevents shell expansion and ordinary PATH-based executable substitution. However, these protections do not address replacement or modification of the executable itself. If another deployment component or a sufficiently privileged attacker modifies /usr/local/bin/tg_search, subsequent skill invocations will execute the replacement under the skill runner's identity.

The external executable also operates in an environment described as having access to an already-authorized Telethon session. Its actual use of that session cannot be validated from this package.

Attack Path

1. An attacker obtains permission to create or modify /usr/local/bin/tg_search, such as through a compromised deployment process, insecure file permissions, or privileged access.
2. The attacker replaces the expected executable with malicious code while retaining the same path and command-line interface.
3. A user or agent invokes run.py with a Telegram search query.
4. run.py executes the attacker-controlled binary and supplies the query and limit.
5. The replacement executable runs with the privileges and environment of the skill runner and may access any Telegram credentials or session resources available to that process.
6. Becaus ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle the Telegram search implementation with the skill so that its complete behavior can be reviewed and versioned.
• If an external executable is required, pin an approved version and verify its cryptographic digest before execution.
• Verify that the executable and all parent directories are owned by a trusted administrative account and are not writable by the skill runner or other unprivileged users.
• Execute the tool under a dedicated, least-privileged operating-system account.
• Use a narrowly scoped Telegram account that does not have access to private chats, administrative functions, or unrelated resources.
• Restrict the subprocess's environment, filesystem access, and network access through sandboxing or containerization.
• Log the verified executable version and digest for each invocation to support integrity monitoring.
• Treat subprocess output as untrusted data even after JSON parsing, and validate it against the documented output schema.

T09 · Insecure Skill Coding Practices

Note

• Location: run.py:10

Finding

Documented Search Limit Is Forwarded Without Validation

Content

View full analysis

Vulnerability Details

File Location: run.py, lines 10–16
Vulnerability Type: Missing input validation
Risk Level: Low

Vulnerable Code

python

limit = sys.argv[2] if len(sys.argv) >= 3 else "10"

p = subprocess.run(
    ["/usr/local/bin/tg_search", query, limit],
    capture_output=True,
    text=True
)

The documented interface states that limit is an integer with a maximum value of 50, but the wrapper neither parses the value as an integer nor enforces a permitted range. Arbitrary strings, negative numbers, zero, and excessively large numeric values are passed directly to the external executable.

Technical Analysis

Argument-array invocation prevents the supplied value from being interpreted by a shell, so this code does not establish a shell-command injection vulnerability. Nevertheless, it fails to enforce the skill's documented trust boundary and delegates validation to an external executable whose implementation was not included in the audit.

If /usr/local/bin/tg_search does not independently validate the argument, malformed or excessive values could cause errors, unexpectedly large Telegram queries, rate-limit consumption, excessive processing, or other implementation-dependent behavior.

Attack Path

1. A caller invokes the wrapper with an invalid or excessive value, such as a negative integer, a nonnumeric string, or a value substantially greater than 50.
2. The wrapper stores the input unchanged in limit.
3. The value is forwarded directly as the third argument to /usr/local/bin/tg_search.
4. If the external executable does not enforce the intended range, it may perform excessive work, reject the request unpredictably, or process malformed input through an unsafe code path.

Impact Assessment

The likely impact is reduced availability, unnecessary Telegram API consumption, rate limiting, or behavior outside the documented contract. The ex ...[truncated 321 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the optional argument as an integer before invoking the subprocess.
• Reject nonnumeric values and enforce the documented inclusive range of 1 through 50.
• Return a stable JSON error with a nonzero exit status when validation fails.
• Retain argument-array invocation and do not introduce shell=True.
• Apply equivalent validation inside /usr/local/bin/tg_search as defense in depth.

Example hardened validation:

python

try:
    limit = int(sys.argv[2]) if len(sys.argv) >= 3 else 10
except ValueError:
    print(json.dumps({"error": "limit must be an integer from 1 to 50"}))
    sys.exit(1)

if not 1 <= limit <= 50:
    print(json.dumps({"error": "limit must be from 1 to 50"}))
    sys.exit(1)

p = subprocess.run(
    ["/usr/local/bin/tg_search", query, str(limit)],
    capture_output=True,
    text=True,
    check=False
)

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run.py (reported line 13)May include surrounding context.

python

query = sys.argv[1]
    limit = sys.argv[2] if len(sys.argv) >= 3 else "10"

    p = subprocess.run(
        ["/usr/local/bin/tg_search", query, limit],
        capture_output=True,
        text=True

Static analysis

No suspicious patterns detected.