Telegram Stickers

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it advertises, but animated stickers are uploaded to a third-party file host by default, which can expose private images unless users opt out.

Install only if you are comfortable with animated sticker files being sent to tmpfiles.org by default. Use --no-upload for local-only output, avoid sensitive photos or proprietary artwork unless uploads are disabled, and install dependencies in a non-privileged virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/make_webm.py:76

Finding

Animated stickers are uploaded to a third-party file host by default

Content

View full analysis

Vulnerability Details

File Location: scripts/make_webm.py:26-32, scripts/make_webm.py:76-99; scripts/sticker.py:109-111
Vulnerability Type: other: Default Third-Party Data Disclosure
Risk Level: Medium

Vulnerable Code

python

def make_webm(
    frames_dir: str,
    output_path: str = None,
    fps: int = 24,
    duration: float = None,
    upload: bool = True,
) -> str:

python

    if upload:
        _upload(output_path)

    return output_path


def _upload(filepath: str):
    """Upload to tmpfiles.org and print a direct download URL."""
    print("Uploading to tmpfiles.org ...")
    try:
        with open(filepath, "rb") as f:
            data = f.read()

        boundary = "----FormBoundary7MA4YWxkTrZu0gW"
        filename = Path(filepath).name
        body = (
            f"--{boundary}\r\n"
            f'Content-Disposition: form-data; name="file"; filename="{filename}"\r\n'
            f"Content-Type: video/webm\r\n\r\n"
        ).encode() + data + f"\r\n--{boundary}--\r\n".encode()

        req = urllib.request.Request(
            "https://tmpfiles.org/api/v1/upload",
            data=body,
            headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
        )

python

    if args.no_upload:
        cmd.append("--no-upload")
    result = subprocess.run(cmd, capture_output=False)

Technical Analysis

The WebM generation function enables uploads by default through upload: bool = True. The primary workflow only suppresses this behavior when the user explicitly supplies --no-upload. Consequently, an animated sticker derived from a user-supplied photo or artwork is read in full and transmitted over HTTPS to tmpfiles.org.

This behavior is documented and is not covert exfiltration or evidence of malicious intent. However, third-party disclosure is unnecessary for local sticker generation, and an ...[truncated 1307 chars]

Remediation

View remediation

Remediation Suggestions

• Change the library default from upload: bool = True to upload: bool = False.
• Replace the opt-out --no-upload workflow with an explicit opt-in --upload option.
• Before uploading, display the destination, identify the file being transferred, and require affirmative user consent.
• Clearly document that the URL may be accessible to anyone who possesses it and disclose the external service's applicable retention policy.
• Keep local output generation as the default and allow users to upload the resulting document directly to Telegram.
• If third-party hosting remains supported, consider configurable approved providers and avoid presenting temporary hosting as a required pipeline step.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:106

Finding

Runtime dependencies are installed without version or integrity pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:106-110
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

bash

pip install "rembg[cpu]" Pillow numpy
# ffmpeg with libvpx-vp9 (system-wide install)

Technical Analysis

The installation instructions request mutable package names without reviewed version constraints or cryptographic hashes. The system dependency is likewise described without a verified version or trusted distribution source. As a result, separate installations can resolve to different artifacts, and future upstream releases are implicitly trusted.

No typosquatted package name, suspicious custom package index, or remote shell installation pipeline was identified. The risk arises from a lack of reproducibility and supply-chain hardening rather than evidence that the currently named dependencies are malicious.

Attack Path

1. A user follows the documented dependency installation command.
2. pip consults the user's configured package index and resolves the latest compatible distributions.
3. If an upstream account, package release, configured mirror, or dependency in the transitive graph has been compromised, the altered artifact is downloaded.
4. Package installation hooks or subsequently imported runtime code execute with the privileges of the user running pip or the sticker scripts.
5. An affected dependency could access files and network resources available to that account or manipulate generated outputs.

Impact Assessment

Exploitation depends on compromise or substitution within the package supply chain; the repository itself does not provide a direct exploit. If a resolved dependency were malicious, code could execute with the privileges of the installing or invoking user. The accessible scope could include that user's files, environment variables, network access, and sticker input/output data. No privilege-escalation mechanism is p ...[truncated 128 chars]

Remediation

View remediation

Remediation Suggestions

• Create a reviewed requirements or lock file containing exact dependency versions.
• Generate and verify cryptographic hashes, such as by using pip install --require-hashes.
• Pin transitive dependencies through a lock-generation process and update them through controlled review.
• Use an explicitly trusted Python package index and protect package-manager configuration from unauthorized mirrors.
• Document a tested minimum or exact ffmpeg version and recommend installation from a trusted operating-system repository.
• Run dependency vulnerability and provenance checks during release preparation and automated testing.
• Install dependencies inside a non-privileged virtual environment rather than using an administrator or root account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is security-relevant because the skill omits or obscures a real third-party upload behavior to tmpfiles.org while presenting itself as a local sticker-processing workflow. Hidden or undeclared network transmission can cause confidential images to be exfiltrated to an external service without informed user consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is security-relevant because the skill omits or obscures a real third-party upload behavior to tmpfiles.org while presenting itself as a local sticker-processing workflow. Hidden or undeclared network transmission can cause confidential images to be exfiltrated to an external service without informed user consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and instructs use of shell execution and network upload behavior but does not declare any explicit tool scope or permissions boundary. In an agent environment, undocumented access to shell and network increases the chance of over-privileged execution, unintended external data transfer, and misuse beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says to use the skill when the user wants to "make, process, or package Telegram stickers from photos or NFT art," which is a wide natural-language trigger without clear boundaries for when this skill should or should not activate. It lacks negative examples or tighter constraints, so ordinary image-processing requests could be matched unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes automatic upload of generated sticker files to tmpfiles.org without a clear warning or explicit consent step. Because user-supplied images may contain private, copyrighted, or sensitive content, silent third-party upload creates a meaningful confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The upload instructions normalize use of tmpfiles.org and direct-download URL generation but omit integrity, retention, and privacy caveats. This makes accidental disclosure more likely and may lead users to believe external hosting is a routine or harmless part of the workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script advertises local sticker conversion but by default uploads the generated file to tmpfiles.org, a third-party host unrelated to Telegram's native sticker workflow. This creates an unexpected data egress path that can leak user content, including potentially sensitive or copyrighted images, beyond the user's intended destination.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_webm.py (reported line 63)May include surrounding context.

python

# NOTE: Do NOT add -loop 0 — that flag is for GIF, not WebM, and causes issues.

    print(f"Running: {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print("ffmpeg stderr:")
        print(result.stderr[-2000:])

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code performs an outbound upload of the generated sticker to tmpfiles.org and prints a direct download URL, which is an exfiltration capability not necessary for local sticker generation. In the context of a media-processing skill, hidden or default external uploads are especially risky because users may provide personal photos or proprietary artwork expecting only local transformation or Telegram submission.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sticker.py (reported line 72)May include surrounding context.

python

sticker_path = src.parent / f"{src.stem}_sticker.png"
    print(f"\n[1/{'3' if args.animate else '1'}] Removing background + creating 512x512 PNG...")
    import subprocess
    result = subprocess.run(
        [sys.executable, str(scripts / "make_sticker.py"), str(src), str(sticker_path)],
        capture_output=False,
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sticker.py (reported line 96)May include surrounding context.

python

duration = args.duration or default_dur

    print(f"\n[2/3] Generating {motion} frames ({duration}s @ {args.fps}fps)...")
    result = subprocess.run(
        [sys.executable, str(scripts / script_name), str(sticker_path),
         "--fps", str(args.fps), "--duration", str(duration),
         "--outdir", str(frames_dir)],

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sticker.py (reported line 113)May include surrounding context.

python

"--fps", str(args.fps), "--duration", str(duration)]
    if args.no_upload:
        cmd.append("--no-upload")
    result = subprocess.run(cmd, capture_output=False)
    if result.returncode != 0:
        sys.exit(result.returncode)

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a Telegram sticker creation pipeline, but this file implements that pipeline by spawning multiple helper scripts and relying on an external binary via subprocess execution. While related to the task, arbitrary process execution is a stronger capability than the user-facing purpose suggests and is not itself called out in the manifest or module documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.