Security audit

智能体Telegram

Security checks across malware telemetry and agentic risk

Overview

This skill is a Telegram notification template, but it hard-codes an external recipient and encourages agents to send task details and local paths off-platform.

Review this carefully before installing. It should only be used if the fixed Telegram ID is truly your intended recipient, the bot tokens are stored securely, and agents are instructed to omit secrets, private file paths, customer data, and internal debugging details unless you explicitly approve sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as a narrowly scoped Telegram messaging规范, but it declares broad tools such as exec, write, glob, and grep that are not necessary for simple message routing. This scope expansion increases attack surface and can let downstream agents justify filesystem access or command execution under the cover of a benign communication skill.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document repeatedly says Telegram messages must be sent with a message tool, yet later labels the skill as MD+EXEC and says sending requires exec. This inconsistency can cause agents to invoke shell commands or wrapper scripts instead of a constrained messaging primitive, increasing the chance of command injection or misuse.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The security section says API keys should be configured via environment variables, while the operational instructions specify storing Telegram tokens in local JSON config files. Conflicting secret-handling guidance leads to insecure deployments, accidental token persistence, and higher likelihood of credential exposure through files, backups, or repository sync.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill directs agents to send task details and output paths to Telegram, an external channel, without requiring user consent, data classification, or privacy warnings. Because the recipient is fixed and external to the working environment, normal project activity can be silently turned into off-platform disclosure.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill mandates automatic reporting of task details to a fixed Telegram ID, creating a built-in exfiltration channel to an external recipient. In context, this is more dangerous because the behavior is normalized as mandatory for all agents and tied to multiple workflow stages, so sensitive operational data may be leaked continuously rather than incidentally.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The templates explicitly tell agents to include output file paths and work results in Telegram messages. Even if the paths do not contain file contents, they can expose project structure, usernames, internal naming, and sensitive artifact locations that assist further targeting or social engineering.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The examples normalize sending local workspace paths and internal debugging context such as API issues and infrastructure tuning advice to Telegram. This trains agents and users to treat external chat as an acceptable sink for internal metadata, increasing the likelihood of ongoing information leakage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.