Security audit

telethon-plus

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about controlling a real Telegram account, but its setup and media-fetching paths create high-impact exposure risks users should review before installing.

Install only if you intend to let an agent operate a real Telegram user account. Bind the service to localhost, set a strong TELETHON_AUTH_KEY, avoid exposing /api/ or /mcp/ to untrusted networks, pin and review the Docker image before use, keep the session string private, disable writes with READ_ONLY or DRY_RUN unless needed, and never pass untrusted URLs to file_url or an untrusted endpoint to TELETHON_POST_TO_URL.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/setup.md:48
Finding: Unauthenticated Full Telegram Account-Control API Exposed on All Host Interfaces
Content: View full analysis
Vulnerability Details

File Location: references/setup.md, lines 48-56
Vulnerability Type: Missing authentication and unsafe network exposure
Risk Level: Critical

Vulnerable Code

bash
docker run -d --name telethon-plus \ -p 8080:8080 \ -e TELETHON_API_ID=123456 \ -e TELETHON_API_HASH=your-api-hash \ -e TELETHON_SESSION='1Aa...long-string-from-login...' \ -v $HOME/telethon-cache:/cache \ --restart unless-stopped \ psyb0t/telethon-plus

The documented Compose example similarly publishes the service while leaving authentication commented out:

yaml
services: telethon-plus: image: psyb0t/telethon-plus ports: - "8080:8080" environment: TELETHON_API_ID: "123456" TELETHON_API_HASH: "your-api-hash" TELETHON_SESSION: "1Aa...long-string-from-login..." # TELETHON_AUTH_KEY: "a-strong-random-secret"

Technical Analysis

Docker's -p 8080:8080 syntax publishes the container port on all host interfaces by default. At the same time, TELETHON_AUTH_KEY is not configured in the primary installation example. The documentation states that an empty authentication key leaves all API and MCP routes, except for the intentionally public status routes, accessible without authentication.

This service controls a real Telegram user account rather than a restricted bot account. Its API includes reading private conversations, sending and modifying messages, downloading attachments, deleting messages and chats, joining groups, and performing administrative actions. Consequently, exposing this API without authentication crosses a critical access-control boundary.

Although the documentation contains warnings recommending loopback binding and authentication, the copy-and-paste installation commands establish the unsafe configuration directly.

Attack Path

An operator follows the documented Quick Install command.

Docker ...[truncated 1177 chars]
Remediation: View remediation
Remediation Suggestions

Change the default Docker publication to loopback-only:

bash
-p 127.0.0.1:8080:8080

Require a cryptographically strong TELETHON_AUTH_KEY in every installation example.

Make the server refuse to start when authentication is disabled on a non-loopback listener.

Use TLS through a correctly configured reverse proxy for all remote access.

Apply firewall rules that restrict access to explicitly authorized management hosts.

Prefer a deny-by-default deployment profile, with remote exposure requiring an explicit opt-in.

Consider splitting read, write, and administrative privileges into separate scopes instead of giving every bearer token complete account control.

Keep destructive and administrative endpoints disabled unless they are explicitly needed.

T09 · Insecure Skill Coding Practices

Error

Location: scripts/telethon.sh:76
Finding: Unrestricted Server-Side URL Fetching Enables SSRF
Content: View full analysis
Vulnerability Details

File Location: scripts/telethon.sh, lines 76-84
Vulnerability Type: Server-Side Request Forgery
Risk Level: High

Vulnerable Code

bash
sendfile) chat="${1:-}"; url="${2:-}" [[ -n "$chat" && -n "$url" ]] || die "sendfile: <chat> <file_url> [caption...] required" shift 2 caption="$*" body=$(jq -n --arg chat "$chat" --arg url "$url" --arg cap "$caption" \ '{chat:$chat, file_url:$url} + (if $cap == "" then {} else {text:$cap} end)') curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \ -d "$body" "$URL/api/messages" ;;

Technical Analysis

The sendfile command accepts a caller-provided URL and forwards it unchanged as file_url. The Telethon server then fetches that URL from its own container and network context.

The wrapper does not enforce:

HTTPS.

An approved-host allowlist.

Rejection of loopback, private, link-local, multicast, or reserved addresses.

DNS rebinding protection.

Redirect destination validation.

Restrictions against cloud metadata endpoints.

A conservative client-side response-size limit.

The Skill documentation explicitly acknowledges that this behavior can probe private network addresses, but documentation warnings alone do not prevent exploitation. If an untrusted user, incoming Telegram message, scraped page, or model-generated value can influence file_url, the server becomes an SSRF primitive.

Attack Path

An attacker influences the URL supplied to telethon.sh sendfile, directly or through untrusted content processed by an agent.

The wrapper places the URL into the JSON request without validation.

The Telethon container resolves and requests the URL from its own network environment.

The URL targets a loopback service, private network host, container-side service, or link-local metadata endpoint.

The fetched response may be uplo ...[truncated 947 chars]
Remediation: View remediation
Remediation Suggestions

Enforce an explicit allowlist of approved HTTPS hostnames.

Reject all non-HTTPS schemes and URLs containing embedded credentials.

Resolve the destination before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.

Repeat address validation after every redirect and limit the number of redirects.

Pin the connection to the validated address to mitigate DNS rebinding.

Explicitly block cloud metadata destinations and known metadata hostnames.

Apply strict download size, content-type, connection-timeout, and total-timeout limits.

Perform equivalent validation in the server, not only in the shell wrapper, because callers can invoke the API directly.

Prefer client-side download and validated direct upload rather than server-side URL fetching.

Do not derive file_url from Telegram messages, scraped content, or other untrusted sources without explicit operator review.

T08 · Insecure Dependencies

Error

Location: references/setup.md:33
Finding: Unpinned Mutable Container Image Executes Unverified Third-Party Code
Content: View full analysis
Vulnerability Details

File Location: references/setup.md, lines 33-39
Vulnerability Type: Unsafe third-party dependency and mutable container image
Risk Level: High

Vulnerable Code

bash
docker run --rm -it \ -e TELETHON_API_ID=123456 \ -e TELETHON_API_HASH=your-api-hash \ psyb0t/telethon-plus login

The runtime installation also uses the same image without a release tag or immutable digest:

bash
docker run -d --name telethon-plus \ -p 8080:8080 \ -e TELETHON_API_ID=123456 \ -e TELETHON_API_HASH=your-api-hash \ -e TELETHON_SESSION='1Aa...long-string-from-login...' \ -v $HOME/telethon-cache:/cache \ --restart unless-stopped \ psyb0t/telethon-plus

Technical Analysis

The setup instructions execute psyb0t/telethon-plus without a version tag or immutable image digest. This implicitly uses a mutable default tag. The documentation also instructs operators to run docker pull psyb0t/telethon-plus, allowing the effective implementation to change after the Skill package has been audited.

The actual Telegram control-plane implementation is contained in this external image and is not included in the audited project. Therefore, its code, transitive dependencies, build process, and future updates cannot be verified from the Skill files.

The container receives highly sensitive values, including the Telegram API hash and a session string that represents full account access. A compromised publisher account, registry, build pipeline, or mutable image tag could substitute malicious code that reads these secrets or abuses the authenticated Telegram session.

Attack Path

The image publisher account, container registry, or upstream build process is compromised, or the mutable tag is changed.

An operator follows the setup instructions or runs the documented pull command.

Docker retrieves the substituted image because no immutable digest is specifi ...[truncated 1068 chars]
Remediation: View remediation
Remediation Suggestions

Pin the image to a reviewed release and immutable SHA-256 digest:

bash
docker run ... psyb0t/telethon-plus@sha256:REVIEWED_DIGEST

Avoid mutable default or latest tags in all installation and update instructions.

Publish and verify signed container images using a recognized signing mechanism.

Provide build provenance, reproducible build instructions, and a software bill of materials.

Scan the pinned image and its transitive dependencies before deployment.

Document a controlled upgrade process that reviews and updates the digest explicitly.

Run the container as a non-root user with a read-only root filesystem and minimal Linux capabilities.

Restrict mounted volumes and outbound network access to only what the service requires.

Use short-lived or revocable credentials where possible, and immediately revoke the Telegram session if image integrity is in doubt.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (29)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
- Only ever point this skill at an instance **the user runs and owns**, driving **the user's own account** (or an account they are explicitly authorized to operate). - **Do not** send spam, mass-DM strangers, scrape at volume, auto-join channels en masse, or run any automation that violates [Telegram's Terms of Service](https://telegram.org/tos) — that gets the account **banned** (the throttle layer reduces flood risk, it does not make abuse safe). - **Never** provision, escalate, or log in a new account from here. This skill is **consumer-only**: it talks to an already-running, already-authorized instance. First-time login is an operator-side step (see setup) and is out of scope for the agent. - Writes are destructive and act as the user. `DELETE /api/chats` is irreversible; deleting / editing messages and banning users are visible actions others see. Confirm intent before running writes on shared chats. - Never print, log, or echo the session string, `TELETHON_API_HASH`, `TELETHON_AUTH_KEY`, phone numbers, or message contents beyond what the task needs. ## When To Use

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
md
- Only ever point this skill at an instance **the user runs and owns**, driving **the user's own account** (or an account they are explicitly authorized to operate). - **Do not** send spam, mass-DM strangers, scrape at volume, auto-join channels en masse, or run any automation that violates [Telegram's Terms of Service](https://telegram.org/tos) — that gets the account **banned** (the throttle layer reduces flood risk, it does not make abuse safe). - **Never** provision, escalate, or log in a new account from here. This skill is **consumer-only**: it talks to an already-running, already-authorized instance. First-time login is an operator-side step (see setup) and is out of scope for the agent. - Writes are destructive and act as the user. `DELETE /api/chats` is irreversible; deleting / editing messages and banning users are visible actions others see. Confirm intent before running writes on shared chats. - Never print, log, or echo the session string, `TELETHON_API_HASH`, `TELETHON_AUTH_KEY`, phone numbers, or message contents beyond what the task needs. ## When To Use

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
md
- Only ever point this skill at an instance **the user runs and owns**, driving **the user's own account** (or an account they are explicitly authorized to operate). - **Do not** send spam, mass-DM strangers, scrape at volume, auto-join channels en masse, or run any automation that violates [Telegram's Terms of Service](https://telegram.org/tos) — that gets the account **banned** (the throttle layer reduces flood risk, it does not make abuse safe). - **Never** provision, escalate, or log in a new account from here. This skill is **consumer-only**: it talks to an already-running, already-authorized instance. First-time login is an operator-side step (see setup) and is out of scope for the agent. - Writes are destructive and act as the user. `DELETE /api/chats` is irreversible; deleting / editing messages and banning users are visible actions others see. Confirm intent before running writes on shared chats. - Never print, log, or echo the session string, `TELETHON_API_HASH`, `TELETHON_AUTH_KEY`, phone numbers, or message contents beyond what the task needs. ## When To Use

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
-d '{"chat":"me","text":"fixed version","parse_mode":"md"}' | jq

text
## API — `DELETE /api/messages` Bulk delete by ID (body carries the list).

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
md
| Method + path | Body / params | What it does | |---|---|---| | `POST /api/messages/{id}/reactions` | `chat`, `emoji`, `big?` | React to a message | | `DELETE /api/messages/{id}/reactions` | `chat` | Remove your reaction | | `POST /api/messages/{id}/pin` | `chat`, `silent?`, `pm_oneside?` | Pin | | `POST /api/messages/{id}/unpin` | `chat` | Unpin |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 511)May include surrounding context.
md
For a small send/read wrapper over `TELETHON_PLUS_URL`, see [`scripts/telethon.sh`](scripts/telethon.sh).

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 27)May include surrounding context.
With the repo (writes the session straight into .env):

bash
cp .env.example .env $EDITOR .env # set TELETHON_API_ID and TELETHON_API_HASH make login # interactive: phone → SMS code → optional 2FA make run # run locally on :8080

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 28)May include surrounding context.
bash
cp .env.example .env $EDITOR .env # set TELETHON_API_ID and TELETHON_API_HASH make login # interactive: phone → SMS code → optional 2FA make run # run locally on :8080

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
bash
# Text. curl -s -X POST $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' \ -d '{"chat":"me","text":"**hello** from a container","parse_mode":"md","silent":true}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 469)May include surrounding context.
bash
# Text. curl -s -X POST $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' \ -d '{"chat":"me","text":"**hello** from a container","parse_mode":"md","silent":true}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.
bash
# Text. curl -s -X POST $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' \ -d '{"chat":"me","text":"**hello** from a container","parse_mode":"md","silent":true}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This example uses file_url, which causes the server to fetch a caller-supplied URL server-side. That creates a real SSRF surface: if an agent passes untrusted or attacker-influenced URLs, the container can probe internal services, cloud metadata endpoints, or other private network resources reachable from the host.
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
-d '{"chat":"me","text":"hello from a container","parse_mode":"md","silent":true}' | jq

Media from a URL (text becomes the caption).

curl -s -X POST $TELETHON_PLUS_URL/api/messages
-H 'Content-Type: application/json'
-d '{"chat":"me","file_url":"https://example.com/photo.jpg","text":"a caption"}' | jq

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
| link_preview | bool | true | Show link previews |

bash
curl -s -X PATCH $TELETHON_PLUS_URL/api/messages/4242 \ -H 'Content-Type: application/json' \ -d '{"chat":"me","text":"fixed version","parse_mode":"md"}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

Irreversible, and with revoke: true (the default) it deletes for everyone in the chat, not just you. Confirm the exact chat and message_ids with the user before calling this on a shared chat.

bash
curl -s -X DELETE $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' \ -d '{"chat":"me","message_ids":[4242,4243],"revoke":true}' | jq # { "deleted": 2, "requested": 2 }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 499)May include surrounding context.

Irreversible, and with revoke: true (the default) it deletes for everyone in the chat, not just you. Confirm the exact chat and message_ids with the user before calling this on a shared chat.

bash
curl -s -X DELETE $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' \ -d '{"chat":"me","message_ids":[4242,4243],"revoke":true}' | jq # { "deleted": 2, "requested": 2 }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
| max_id | int | 0 | Mark up to this message ID. 0 = all. |

bash
curl -s -X POST $TELETHON_PLUS_URL/api/messages/read \ -H 'Content-Type: application/json' -d '{"chat":"me","max_id":0}' | jq # { "ok": true }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
| POST /api/messages/{id}/unpin | chat | Unpin |

bash
curl -s -X POST $TELETHON_PLUS_URL/api/messages/4242/reactions \ -H 'Content-Type: application/json' -d '{"chat":"me","emoji":"🔥"}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

Destructive. DELETE /api/chats permanently deletes the chat for everyone in it and cannot be undone. Require explicit user confirmation naming the exact chat before calling it — prefer leaving it disabled/unused unless the task genuinely needs it.

bash
curl -s -X POST $TELETHON_PLUS_URL/api/chats \ -H 'Content-Type: application/json' -d '{"title":"my-group","megagroup":true}' | jq # { "id": 1234567890, "type": "Channel", "title": "my-group" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

Admin ops act on other people's membership/permissions and are visible to the whole chat. Require explicit user confirmation naming the exact chat and target user before calling ban, kick, or promote.

bash
curl -s -X POST "$TELETHON_PLUS_URL/api/chats/-1001234567890/admin/ban" \ -H 'Content-Type: application/json' -d '{"user":"@baduser"}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 429)May include surrounding context.
bash
# tools/list curl -s $TELETHON_PLUS_URL/mcp/ \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.
Note to self (Saved Messages)

bash
curl -s -X POST $TELETHON_PLUS_URL/api/messages \ -H 'Content-Type: application/json' -d '{"chat":"me","text":"remember this"}' | jq

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The documented docker run -d example deploys psyb0t/telethon-plus without a pinned tag or digest, so future pulls may silently run a different image than the operator reviewed. Because this container handles a Telegram session string that grants full account access, a compromised or unexpectedly changed upstream image could expose or misuse highly sensitive credentials and account capabilities.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: docker pull psyb0t/telethon-plus fetches the latest available image without version pinning, creating a supply-chain risk and making reviewed deployments drift over time. In this context the danger is elevated because the service stores and uses a Telegram session equivalent to full account access, so an unreviewed image update could compromise messages, contacts, and account actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/telethon.sh (reported line 73)May include surrounding context.
sh
shift [[ $# -gt 0 ]] || die "send: text required" body=$(jq -n --arg chat "$chat" --arg text "$*" '{chat:$chat, text:$text}') curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \ -d "$body" "$URL/api/messages" ;; sendfile)

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Ae1

Credential Access

Credential Access

External Transmission

External Transmission

External Transmission

External Transmission

Media from a URL (text becomes the caption).

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Note to self (Saved Messages)

Rp1

Rp1

Rp1

External Transmission

Static analysis