Telegram-Bot-managerj

• Analyzed: May 12, 2026, 4:32 AM
• Findings: 1
• Version: 1.0.0
• Hash: fdaaf577048dbdd04568053c1eb396c840274c26da06c640342c05e18ce5f8a0
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its extremely broad default scope and a significant vulnerability in token handling. The `scripts/server.cjs` file, as described in `SKILL.md`, defaults to exposing the entire `C:\` drive via an HTTP server. While authentication and path traversal checks are implemented, the server allows the access token to be passed in URL query parameters, which can lead to token leakage in server logs and browser history (`scripts/server.cjs`, `assets/index.html`). This vulnerability, combined with the 'god-mode' level of access, poses a high risk if the token is compromised, allowing unauthorized read access to the entire system drive.