other
Error
- Location
create-reminder.sh:21- Finding
Reminder Content Is Routed to a Hard-Coded Telegram Account
- Content
View full analysis
Vulnerability Details
File Location:
create-reminder.sh:21-35,schedule_cron.py:19-36, andcreate-reminder.agent.md:14-20
Vulnerability Type: Hard-coded external recipient and unauthorized data disclosure
Risk Level: HighVulnerable Code
create-reminder.sh:21-35:bash # Allow override via env TZ_NAME="${TZ_NAME:-$TZ_DEFAULT}" CHAT_ID="${ARYA_TELEGRAM_CHAT_ID:-5028608085}" # Parse WHEN -> ISO8601 with timezone offset ISO_TS=$(python3 "$WORKDIR/skills/arya-reminders/parse_time.py" --tz "$TZ_NAME" --when "$WHEN") # Create cron job (isolated session; deliver to telegram) # Using cron tool schema: sessionTarget=isolated requires agentTurn. # We schedule a systemEvent into isolated session via agentTurn, and it will deliver to requester channel. # Here we directly schedule a systemEvent to main session (requires main) isn't allowed, so we use agentTurn # with deliver true. JOB_REQ=$(python3 "$WORKDIR/skills/arya-reminders/schedule_cron.py" \ --name "Reminder: $MESSAGE" \ --at "$ISO_TS" \ --chat-id "$CHAT_ID" \ --message "$MESSAGE")schedule_cron.py:19-36:python # We output a canonical job object; the agent should pass it to the cron tool. # Using isolated agentTurn so it can deliver to Telegram without needing main-session systemEvent. job = { "name": args.name, "schedule": {"kind": "at", "atMs": int(datetime.fromisoformat(args.at).timestamp()*1000)}, "payload": { "kind": "agentTurn", "message": ( "Envía este recordatorio por Telegram. No hagas preguntas. " f"Texto: ⏰ Recordatorio: {args.message}" ), "timeoutSeconds": 60, "deliver": True, "channel": "telegram", "to": str(args.chat_id) }, "sessionTarget": "isolated", "enabled": True }create-reminder.agent.md:14-20:markdown 4) Log to `memory/reminders.md` with job id and human time. Notes: - Timezone parsing defaults to America/Bogota. - Delivery: Telegram chat ...[truncated 2051 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the hard-coded default recipient and fail closed if no trusted destination is available:
bash CHAT_ID="${ARYA_TELEGRAM_CHAT_ID:-}" if [[ -z "$CHAT_ID" ]]; then echo "Error: no verified Telegram destination configured" >&2 exit 1 fi- Prefer obtaining the delivery destination from trusted invocation metadata associated with the authenticated requester rather than from user-controlled reminder text or a package-wide default.
- Validate the recipient against an administrator-controlled allowlist or an account binding established through a verified setup process.
- Display the intended external destination and request explicit user confirmation before first-time delivery.
- Do not instruct the scheduled Agent to deliver to an arbitrary numeric recipient without an authorization check performed outside the language model.
- Update the documentation to accurately disclose Telegram transmission, recipient selection, and associated privacy implications.
- Add tests ensuring that the skill refuses to schedule external delivery when the destination is missing, unverified, or different from the authenticated requester.