ClawHub
Back to skill

Security audit

Telethon Master

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides broad Telegram account control, including private message access and destructive channel/message actions, but its safeguards are mostly advisory and read access is explicitly unrestricted.

Install only if you intentionally want an agent to operate a real Telegram user account through an existing Telethon bridge. Configure TG_ALLOWED_CHAT_IDS before use, avoid enabling it for private chats unless necessary, require explicit confirmation for reads, downloads, joins, button clicks, forwards, deletes, and channel changes, and verify the referenced local services, session, VPS tunnel, and .env credentials are yours and properly secured.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill exposes destructive and privacy-impacting capabilities such as reading chat history, downloading media, joining chats, reacting/clicking buttons, and deleting channels/messages, but the documented safeguards are incomplete and partly advisory rather than enforced. While `TG_ALLOWED_CHAT_IDS` restricts many write operations, read operations are explicitly unrestricted, and the skill text does not consistently require explicit user confirmation for sensitive actions, creating a real risk of unauthorized access, privacy violations, or destructive account activity if invoked by an agent in the wrong context.

Static analysis

No suspicious patterns detected.