telegram-send-photo

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 1.0.0
• Hash: 14e082b750e95ff4336db25dd111cb7f8d2af5d9bc3ad04107666d37ba359c33
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the hardcoded Telegram bot token and chat ID present in both `SKILL.md` and `telegram_send_photo.py`. While the skill's stated purpose is benign (sending photos via Telegram), hardcoding sensitive credentials like a bot token is a significant security vulnerability. This exposes the token, allows anyone with access to the skill bundle to use the bot, and forces communication to a specific chat ID, which could lead to unintended data exposure or unauthorized use of the bot, even if the code's direct intent is not malicious.