Session Context Injector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent Telegram reorientation purpose, but it sends local project status content to externally supplied Telegram chats without strong destination validation, redaction, or HTML escaping.

Install only if the operator trusts the configured Telegram rooms and project STATUS.md content. Treat STATUS.md as externally shareable before use, keep secrets and customer data out of those sections, verify chat IDs independently, and prefer adding an allowlist, message preview, redaction, and HTML escaping before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:164

Finding

Unvalidated Telegram destination can disclose project status information

Content

View full analysis

/STATUS.md`, incorporates the extracted resume point and blockers into a message, and transmits that message to a caller-provided Telegram `chat_id`. Relevant source and message-construction code: ```python def parse_status(slug: str) -> dict: path = PROJECTS_DIR / slug / "STATUS.md" if not path.exists(): return {} text = path.read_text() def extract(heading: str) -> str: m = re.search( rf"##+ {re.escape(heading)}\s*\n(.*?)(?=\n##|\Z)", text, re.DOTALL ) return m.group(1).strip()[:400] if m else "" resume = extract("RESUME FROM HERE") or extract("Resume From Here") or "" blockers = extract("Blockers") or extract("Open Blockers") or "" resume = re.sub(r"^[-*] ", "", resume, flags=re.MULTILINE).strip() blockers = re.sub(r"^[-*] ", "", blockers, flags=re.MULTILINE).strip() return { "resume": resume[:300], "blockers": blockers[:200], } ``` ```python def build_group_message(project_name: str, slug: str, status: dict) -> str: resume = status.get("resume", "") blockers = status.get("blockers", "") lines = [ f"🔄 Session Refresh — {project_name}", "", "I've refreshed my context. Here's where we are:", "", ] if slug: lines.append(f"📌 Project: {slug.upper()}") if resume: lines.append(f"📍 Resume from: {resume}") if blockers and blockers.lower() not in ("none", "—", "-", ""): lines.append(f"🚧 Blockers: {blockers}") lines += [ "", "My memory and project files are fully updated. " "Jump back in wheneve ...[truncated 2837 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:90

Finding

Unescaped project metadata permits Telegram HTML injection

Content

View full analysis

str: resume = status.get("resume", "") blockers = status.get("blockers", "") lines = [ f"🔄 Session Refresh — {project_name}", "", "I've refreshed my context. Here's where we are:", "", ] if slug: lines.append(f"📌 Project: {slug.upper()}") if resume: lines.append(f"📍 Resume from: {resume}") if blockers and blockers.lower() not in ("none", "—", "-", ""): lines.append(f"🚧 Blockers: {blockers}") lines += [ "", "My memory and project files are fully updated. " "Jump back in whenever you're ready — just pick up the thread. 🐾", ] return "\n".join(lines) ``` The same issue exists in the welcome-message builder: ```python def build_welcome_message(project_name: str, slug: str, purpose: str, allowed_topics: list[str]) -> str: topic_list = "\n".join(f"• {t}" for t in allowed_topics[:8]) return ( f"👋 Welcome to {project_name}\n\n" f"{purpose}\n\n" f"What I can help with here:\n{topic_list}\n\n" f"I have full project context loaded. Ask me anything within scope. 🐾" ) ``` The resulting text is sent with: ```python "parse_mode": "HTML", ``` Telegram's HTML mode interprets supported tags rather than displaying them as plain text. Consequently, values originating in `STATUS.md`, project metadata, room purpose, or allowed topics can break out of the intended formatting and introduce attacker-selected markup, including deceptive emphasis and hyperlin ...[truncated 1811 chars]

Remediation

View remediation

`, `&`, quotes, nested tags, injected links, malformed tags, and multibyte text near the Telegram length limit. 7. Apply the same encoding policy consistently to group, direct, and welcome message variants. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is explicitly designed to send project context into Telegram chats and to append related entries to local memory/STATUS files, but it provides no explicit user-facing warning, confirmation step, or sensitivity gate before doing so. In this context, that omission increases the chance of unintentional disclosure of internal project details or personal data into external chats and persistent logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's stated purpose is to re-inject prior project/session context into Telegram after resets, which directly encourages disclosure of stored context into an external messaging platform. Because the message content is framed as normal operating behavior and lacks least-privilege controls, an operator may disclose more historical context than necessary to the wrong audience or channel.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section extracts free-form text from STATUS.md and injects it into outbound Telegram messages without semantic review, classification, or redaction. Since STATUS.md may contain secrets, internal incident details, customer data, roadmap information, or sensitive blockers, the skill can exfiltrate confidential data to external chats through normal use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The welcome template claims that full project context is loaded and invites broad questioning within scope, which can prime users to solicit extensive stored information that may not be appropriate for that room or collaborator. In a collaboration setting, this messaging weakens confidentiality boundaries and encourages oversharing by design.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill performs outbound transmission to the Telegram Bot API, which is expected functionality, but it becomes security-relevant because the transmitted data can include extracted project context from local files. The danger is not the network call alone, but the combination of external transmission with insufficient validation of message sensitivity and destination correctness.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

print(f"[DRY-RUN] → {chat_id}: {text[:100].replace(chr(10),' ')}…")
        return True
    try:
        url     = f"https://api.telegram.org/bot{bot_token}/sendMessage"
        payload = json.dumps({
            "chat_id":    chat_id,
            "text":       text,

Static analysis

No suspicious patterns detected.