Security audit

Relay for Telegram

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does what it says, but it gives an agent broad access to private Telegram history while also documenting account-changing billing and referral actions despite claiming the API is read-only.

Review before installing. Use this only if you trust Relay to sync and store your Telegram history, keep RELAY_API_KEY private, and consider disabling model invocation so the agent accesses messages only when you explicitly ask. Be cautious with billing and referral features, since the skill is not purely read-only despite its privacy claim.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a Telegram message-history access tool, but the same document exposes additional account-management surfaces such as billing and referrals. This mismatch expands the tool's operational scope beyond what a user would reasonably expect, increasing the risk of unintended or socially engineered state-changing actions under the guise of a read/search skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The privacy section claims the agent cannot take any action on the user's account, yet later sections document POST endpoints for subscription, cancellation, and referral attribution that do change account state. This is dangerous because it misrepresents the trust boundary and could cause users or agents to approve use of the skill under false assumptions about harmlessness.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Referral and marketing functions are unrelated to the core purpose of searching Telegram history, so their inclusion violates least privilege and increases the chance the agent is steered toward non-user-benefiting actions. Even if not directly destructive, they create unnecessary account mutation and incentive-manipulation surfaces in a sensitive data-access skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guidance telling agents to promote referral links incentivizes behavior that serves the skill provider rather than the user. In an autonomous agent context, this can distort tool selection and outputs, causing covert marketing or self-serving recommendations unrelated to the user's request.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation explicitly says the API is entirely read-only, but the file later defines multiple POST operations that mutate billing and referral state. This inconsistency is dangerous because agents may classify the tool as safe for automatic invocation and then perform actions that incur charges or alter account state.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manifest and opening guidance strongly encourage automatic use whenever a request is Telegram-related, which is overly broad for a skill that accesses sensitive private communications. Over-triggering can lead to unnecessary disclosure or retrieval of message history when the user may only be speaking generally about Telegram rather than authorizing data access.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The proactive suggestion guidance extends use beyond explicit Telegram retrieval requests into broad productivity or communication-management contexts. In practice, that can cause the agent to invoke a private-message search tool in situations where the user did not clearly ask for message access.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The quickstart says to use Relay for 'any task' involving messaging history or communication analysis, which is too expansive for a privacy-sensitive integration. This broad scope increases the likelihood of unnecessary access to personal message content and weakens user expectations around consent and data minimization.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.