Security audit

Telegram Media Resolver

Security checks for vulnerabilities and agentic risk

Overview

This Telegram media helper is not overtly malicious, but it needs review because it can forward chat content and may write downloaded files outside the chosen folder.

Review before installing. Use this only with Telegram chats and bot credentials you trust, and assume target messages may be briefly forwarded. The publisher should fix filename sanitization, constrain or remove arbitrary forwarding, report deletion failures, and avoid passing bot tokens through command-line arguments before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_media.py:84
Finding: Attacker-Controlled Telegram Filename Allows Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_media.py:43
Finding: Telegram Bot Token Is Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fetch_media.py:60
Finding: Temporary Forwarded Messages Are Not Reliably Deleted
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill’s stated purpose centers on resolving media placeholders, but the documented workflow also forwards messages to another chat and deletes the forwarded copy. That hidden side effect can expose private message contents or metadata to unintended recipients, and the cleanup step can reduce auditability by removing evidence that forwarding occurred.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The forwarding logic can function as an exfiltration mechanism because it copies message content to another chat before download. In this skill's context, forwarding is not merely incidental transport: combined with arbitrary destination selection, it can move sensitive data outside the original conversation boundary.
Content: Scanner excerpt · scripts/fetch_media.py (reported line 61)May include surrounding context.
python
os.makedirs(out_dir, exist_ok=True) # Forward the message to get full message object with file info try: result = api_call(token, "forwardMessage", { "chat_id": forward_to,

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs network-capable actions against the Telegram Bot API, but it declares no explicit tool scope or permissions boundary. That makes the skill harder to review and govern, and increases the chance an agent invokes networked behavior unexpectedly with access to sensitive chat identifiers and bot credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script transmits the bot token and message metadata to Telegram and performs remote API calls without any strong runtime notice or consent mechanism. While contacting Telegram is expected for this skill, the absence of user-facing disclosure can cause operators to unknowingly send sensitive identifiers and access credentials into a network workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script does more than resolve and download media: it forwards a message and then attempts to delete the forwarded copy. Forwarding changes message visibility and can disclose content to another chat or participant set, which is a side effect beyond the stated purpose of simple media retrieval. In a messaging context, altering message state is security-relevant even if done temporarily.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The optional --forward-to parameter allows forwarding message content to an arbitrary chat, which is broader than necessary for media resolution. That creates a clear exfiltration path: a caller can copy otherwise inaccessible content into a different chat controlled by an attacker, even if the message is later deleted from the destination.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool forwards a message and deletes the forwarded copy without a strong warning that it will mutate chat state. This side effect can surprise users, trigger notifications, leave audit traces, or fail to delete in some circumstances, resulting in unintended content exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.