Telegram Cloud Storage

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 AM UTC
• Version: 1.8.2

Overview

This skill appears to be a coherent Teldrive wrapper, but it installs an unverified external executable and handles powerful storage credentials with weak safeguards.

Install only if you are comfortable running an unverified prebuilt Teldrive binary from GitHub and giving the skill access to Telegram, database, JWT, and session credentials. Use a dedicated database user, strong new JWT secret, restrictive permissions on config files, avoid running as root, review the binary source/release yourself, and be careful with agent-triggered delete, upload, and download commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install_binary.sh:2

Finding

External Teldrive binary is downloaded and installed without integrity verification

Content

View full analysis

"$LOG_DIR/stdout.log" 2>&1 & ``` This behavior is necessary to install Teldrive, but downloading executable code without independent integrity verification exceeds the minimum safe trust model for that functionality. ### Attack Path 1. An attacker compromises the upstream release, maintainer account, artifact storage, or another trusted distrib ...[truncated 1234 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:19

Finding

Telegram, database, and JWT secrets are collected visibly and stored without enforced restrictive permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:29

Finding

Unescaped user input is interpolated into sed programs and TOML configuration

Content

View full analysis

Remediation

View remediation

&2 exit 1 } ``` 3. Reject newline, carriage-return, and other control characters in interactive values. 4. If `sed` must be retained, escape every replacement metacharacter—including backslashes, ampersands, and the selected delimiter—and separately escape values according to TOML string rules. 5. Write the generated configuration to a restrictive temporary file, parse or validate it, and atomically move it into place only after validation succeeds. 6. Run Teldrive's configuration validation mode, if available, before starting the server. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The delete command performs an irreversible remote deletion immediately based on a provided file ID, with no confirmation or dry-run option. In an agent skill context, where commands may be triggered indirectly or composed automatically, this raises the chance of accidental or unauthorized destructive actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares executable installation and operational scripts and clearly requires capabilities such as shell execution, environment access, file access, and likely network access, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or platform will run the skill with broader privileges than necessary, making misuse or unintended side effects harder to constrain or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to use a JWT token and a Telegram session hash, and even points to local storage locations where those secrets can be retrieved, but it does not prominently warn that these are sensitive authentication artifacts. Because these credentials can enable access to stored files and Telegram-backed sessions, inadequate disclosure raises the risk of accidental exposure, unsafe handling, or over-trusting downstream tools and logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template ships with a JWT secret set to a known placeholder value, and there is no accompanying hard-fail or strong warning in the file itself to prevent deployments from using it unchanged. If an operator leaves this value in place, attackers who know or guess the default can forge valid JWTs, impersonate users, and potentially gain unauthorized access to the Telegram-backed storage service.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from requests.get (line 83, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 30)May include surrounding context.

python

def list_files(token, path="/"):
    url = f"{BASE_URL}/files"
    params = {"path": path, "page": 1, "order": "asc", "sort": "name"}
    res = requests.get(url, headers=headers(token), params=params)
    res.raise_for_status()
    return res.json()

Tainted flow: 'url' from requests.get (line 83, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 37)May include surrounding context.

python

def mkdir(token, path):
    url = f"{BASE_URL}/files/mkdir"
    payload = {"path": path}
    res = requests.post(url, headers=headers(token), json=payload)
    res.raise_for_status()
    return True

Tainted flow: 'url' from requests.get (line 83, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 67)May include surrounding context.

python

def mkdir(token, path):
    url = f"{BASE_URL}/files/mkdir"
    payload = {"path": path}
    res = requests.post(url, headers=headers(token), json=payload)
    res.raise_for_status()
    return True

Tainted flow: 'url' from requests.get (line 83, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 96)May include surrounding context.

python

def mkdir(token, path):
    url = f"{BASE_URL}/files/mkdir"
    payload = {"path": path}
    res = requests.post(url, headers=headers(token), json=payload)
    res.raise_for_status()
    return True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The upload_file function reads a local file and sends its contents over HTTP via requests.post, but there is no confirmation prompt, warning print, or explanatory comment disclosing that local data will be transmitted. Because this operation moves user data off the local system, it should be explicitly disclosed to the user.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from requests.get (line 83, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 54)May include surrounding context.

python

h["Content-Type"] = "application/octet-stream"
    
    with open(local_path, "rb") as f:
        res = requests.post(url, headers=h, params=params, data=f)
    res.raise_for_status()
    
    url = f"{BASE_URL}/files"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The download function writes server-supplied content to an arbitrary caller-provided local path with no validation, overwrite protection, or safety prompt. In an agent or automation context, this can overwrite sensitive files or place untrusted content in dangerous locations, increasing the risk beyond a simple CLI convenience issue.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from requests.get (line 83, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 86)May include surrounding context.

python

url = f"{BASE_URL}/files/{file_id}/{name}"
    params = {"download": "1", "hash": session_hash}
    
    with requests.get(url, params=params, stream=True) as r:
        r.raise_for_status()
        with open(local_path, "wb") as f:
            for chunk in r.iter_content(chunk_size=8192):

Tainted flow: 'url' from requests.get (line 83, network input) → requests.patch (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/client.py (reported line 103)May include surrounding context.

python

def rename_file(token, file_id, new_name):
    url = f"{BASE_URL}/files/{file_id}"
    payload = {"name": new_name}
    res = requests.patch(url, headers=headers(token), json=payload)
    res.raise_for_status()
    return res.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script downloads a prebuilt executable from the network and installs it locally without any integrity verification, signature check, checksum validation, or user confirmation. If the release asset, GitHub account, DNS/TLS path, or distribution channel is compromised, users may install and execute a malicious binary with the permissions of the invoking user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/manage.sh (reported line 23)May include surrounding context.

sh

fi

        echo "Starting Teldrive..."
        nohup "$BIN" run --config "$CONFIG" > "$LOG_DIR/stdout.log" 2>&1 &
        echo $! > "$PID_FILE"
        echo "Started. PID: $(cat "$PID_FILE")"
        echo "Logs: $LOG_DIR/stdout.log"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup script prompts for sensitive values including the Telegram app hash, database connection string, and JWT secret using normal terminal input, which causes secrets to be echoed on screen and potentially exposed to shoulder-surfing, terminal logging, or shell session recording. It also writes those secrets directly into a local config file without warning about file permissions or storage risk, increasing the chance of credential disclosure on multi-user systems or poorly secured hosts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.