ClawHub
Back to skill

Security audit

telethon-plus

Security checks across malware telemetry and agentic risk

Overview

This skill gives an agent powerful Telegram account control, but the artifacts clearly disclose that access, its risks, and the expected safeguards.

Install only if you intend to let an agent operate a real Telegram user account. Keep the service on localhost or behind TLS, set TELETHON_AUTH_KEY before exposing it, use read-only or dry-run mode when testing, do not enable TELETHON_POST_TO_URL unless the endpoint is trusted, and require exact confirmation before any delete, admin, join, leave, or bulk action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This branch performs irreversible message deletion via an HTTP DELETE call, but the code provides no confirmation prompt or runtime warning before executing it. While the header comment mentions common delete operations, it does not explicitly warn that this action deletes messages immediately.

External Transmission

Medium
Category
Data Exfiltration
Content
shift
    [[ $# -gt 0 ]] || die "send: text required"
    body=$(jq -n --arg chat "$chat" --arg text "$*" '{chat:$chat, text:$text}')
    curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \
      -d "$body" "$URL/api/messages"
    ;;
  sendfile)
Confidence
70% confidence
Finding
curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
caption="$*"
    body=$(jq -n --arg chat "$chat" --arg url "$url" --arg cap "$caption" \
      '{chat:$chat, file_url:$url} + (if $cap == "" then {} else {text:$cap} end)')
    curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \
      -d "$body" "$URL/api/messages"
    ;;
  delete)
Confidence
70% confidence
Finding
curl -fsS -X POST "${auth[@]}" -H 'Content-Type: application/json' \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
[[ $# -gt 0 ]] || die "delete: at least one message id required"
    ids=$(printf '%s\n' "$@" | jq -R 'tonumber' | jq -s '.')
    body=$(jq -n --arg chat "$chat" --argjson ids "$ids" '{chat:$chat, message_ids:$ids}')
    curl -fsS -X DELETE "${auth[@]}" -H 'Content-Type: application/json' \
      -d "$body" "$URL/api/messages"
    ;;
  *)
Confidence
70% confidence
Finding
curl -fsS -X DELETE "${auth[@]}" -H 'Content-Type: application/json' \ -d

Tool Parameter Abuse

Low
Category
Tool Misuse
Content
- **Declared capabilities** (see `permissions:` in the frontmatter): `shell` (setup-only), `network` (runtime HTTP), and full Telegram account access. **Setup-only shell vs. runtime API is a hard line** — `docker run` / `docker compose` / `curl` in [references/setup.md](references/setup.md) are one-time operator commands to stand up the container; every runtime call this skill makes afterward is a plain HTTP request (`curl` as an HTTP client, or MCP), never a new shell/docker invocation against the host.
- **Outbound HTTP** — every API call is a `curl`/HTTP request to the `telethon-plus` server (`$TELETHON_PLUS_URL`), and the server itself makes outbound calls to Telegram's MTProto servers and, when `file_url` is used, to whatever URL is given (see the SSRF note below).
- **Drives a full-access Telegram user account** — read AND write AND admin, not a sandboxed bot. Any call this skill makes acts as the account owner (see "Authorized / responsible use" below for the account-level rules).
- **Destructive / admin operations require explicit user confirmation** naming the exact target (chat, message IDs, user) before running — see the per-endpoint warnings in the API tables below (`DELETE /api/chats`, ban/kick/promote, bulk `DELETE /api/messages`).
- **Deployment:** bind the server to `localhost`/loopback or put it behind TLS on a reverse proxy, set `TELETHON_AUTH_KEY` (empty = no auth, wide open), and never expose `/mcp/` or `/api/` to untrusted agents/networks — either surface hands out full account control. See [references/setup.md](references/setup.md) for the full deployment + auth guidance.

## Authorized / responsible use
Confidence
15% confidence
Finding
DELETE /api/chats`,

Tool Parameter Abuse

Low
Category
Tool Misuse
Content
- **Declared capabilities** (see `permissions:` in the frontmatter): `shell` (setup-only), `network` (runtime HTTP), and full Telegram account access. **Setup-only shell vs. runtime API is a hard line** — `docker run` / `docker compose` / `curl` in [references/setup.md](references/setup.md) are one-time operator commands to stand up the container; every runtime call this skill makes afterward is a plain HTTP request (`curl` as an HTTP client, or MCP), never a new shell/docker invocation against the host.
- **Outbound HTTP** — every API call is a `curl`/HTTP request to the `telethon-plus` server (`$TELETHON_PLUS_URL`), and the server itself makes outbound calls to Telegram's MTProto servers and, when `file_url` is used, to whatever URL is given (see the SSRF note below).
- **Drives a full-access Telegram user account** — read AND write AND admin, not a sandboxed bot. Any call this skill makes acts as the account owner (see "Authorized / responsible use" below for the account-level rules).
- **Destructive / admin operations require explicit user confirmation** naming the exact target (chat, message IDs, user) before running — see the per-endpoint warnings in the API tables below (`DELETE /api/chats`, ban/kick/promote, bulk `DELETE /api/messages`).
- **Deployment:** bind the server to `localhost`/loopback or put it behind TLS on a reverse proxy, set `TELETHON_AUTH_KEY` (empty = no auth, wide open), and never expose `/mcp/` or `/api/` to untrusted agents/networks — either surface hands out full account control. See [references/setup.md](references/setup.md) for the full deployment + auth guidance.

## Authorized / responsible use
Confidence
15% confidence
Finding
DELETE /api/messages`).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Only ever point this skill at an instance **the user runs and owns**, driving **the user's own account** (or an account they are explicitly authorized to operate).
- **Do not** send spam, mass-DM strangers, scrape at volume, auto-join channels en masse, or run any automation that violates [Telegram's Terms of Service](https://telegram.org/tos) — that gets the account **banned** (the throttle layer reduces flood risk, it does not make abuse safe).
- **Never** provision, escalate, or log in a new account from here. This skill is **consumer-only**: it talks to an already-running, already-authorized instance. First-time login is an operator-side step (see setup) and is out of scope for the agent.
- Writes are destructive and act as the user. `DELETE /api/chats` is irreversible; deleting / editing messages and banning users are visible actions others see. Confirm intent before running writes on shared chats.
- Never print, log, or echo the session string, `TELETHON_API_HASH`, `TELETHON_AUTH_KEY`, phone numbers, or message contents beyond what the task needs.

## When To Use
Confidence
80% confidence
Finding
DELETE /api/chats`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| Method + path | Body / params | What it does |
|---|---|---|
| `POST /api/messages/{id}/reactions` | `chat`, `emoji`, `big?` | React to a message |
| `DELETE /api/messages/{id}/reactions` | `chat` | Remove your reaction |
| `POST /api/messages/{id}/pin` | `chat`, `silent?`, `pm_oneside?` | Pin |
| `POST /api/messages/{id}/unpin` | `chat` | Unpin |
Confidence
80% confidence
Finding
DELETE /api/messages/{id}/reactions`

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| Method + path | Body / params | What it does |
|---|---|---|
| `POST /api/chats` | `title`, `megagroup?` (default `true`) | Create a supergroup (`true`) or broadcast channel (`false`) |
| `DELETE /api/chats` | `chat` | Delete a supergroup/channel you own — **irreversible** |
| `POST /api/chats/join` | `chat` | Join a public channel/group |
| `POST /api/chats/invite` | `invite` | Join a private chat via a `t.me/+hash` link |
| `POST /api/chats/leave` | `chat` | Leave a channel/group |
Confidence
80% confidence
Finding
DELETE /api/chats`

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.