Security audit

agent-telegram-free

Security checks for vulnerabilities and agentic risk

Overview

This Telegram notification skill is openly a messaging helper, but it routes task details to a fixed Telegram ID and requests broader agent powers than its narrow purpose needs.

Review this carefully before installing. Only use it if Telegram ID 5440561025 is your intended recipient, you are comfortable sending task details and file paths to Telegram, and you can restrict the skill's permissions to the minimum needed. Do not use it for sensitive workspaces without changing the destination and token handling.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill advertises itself as a Telegram messaging convention, but the manifest grants broad capabilities including exec and write. This capability mismatch increases the attack surface and may cause a host agent to authorize file system access or command execution far beyond what users would reasonably expect from the description.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation expands the skill into generic file processing, API integration, and command execution even though the core function is just Telegram notification formatting/routing. That inconsistency can mislead users and platforms into permitting broader behavior and normalizes use of the skill for unrelated higher-risk operations.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The repeated feature list again claims automation, file handling, API use, and command execution that are inconsistent with a Telegram-only skill. Repetition makes the over-claimed scope look intentional or normalized, increasing the chance that downstream users trust the skill with unnecessary privileges.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Declaring exec for a messaging-format skill is dangerous because command execution can be abused to run arbitrary shell commands, access local data, or stage further exfiltration. Since the skill's purpose does not justify this power, the presence of exec represents unnecessary privileged access.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Write permission is not justified by a skill that mainly defines how to send Telegram notifications. Unneeded file modification capability can be abused to alter workspace files, drop payloads, or tamper with configuration under the guise of a harmless messaging helper.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill's security guidance recommends environment variables for secrets, but elsewhere instructs storing Telegram tokens in local JSON configuration files. Conflicting secret-handling advice increases the likelihood of insecure storage, accidental check-in, or local exposure of bot credentials.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill describes sending Telegram messages and using callback URLs without a clear, prominent warning that data will leave the local environment. Users may unknowingly provide sensitive task content, metadata, or URLs that get transmitted to external services.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill hard-codes all outbound messages to a fixed Telegram user ID without a prominent disclosure warning. In context, this is more dangerous than a normal notification skill because it silently routes data to a predetermined external recipient chosen by the skill author rather than the user.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill instructs agents to report task outputs and file paths to a fixed external Telegram recipient through natural-language templates. This creates a direct exfiltration channel for workspace structure, filenames, project details, and potentially sensitive operational context.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The examples explicitly tell the agent to send concrete local file paths to the fixed Telegram recipient, demonstrating data disclosure rather than merely enabling it. Because these are ready-to-copy templates, they materially increase the chance of automatic leakage of workspace information.

Static analysis

No suspicious patterns detected.