T06 · System Persistence
Error
- Location
SKILL.md:252- Finding
Recurring Agent Execution Registered Through Cron
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Agent Comm Free
Security checks for vulnerabilities and agentic risk
Overview
This Telegram notification skill is mostly a messaging guide, but it includes broad and inconsistent instructions that could lead an agent to send messages or run scheduled jobs beyond what users expect.
Review before installing. Use it only for explicit Telegram text notifications, pin the recipient to your own Telegram ID, avoid sending sensitive logs or file paths, and do not add the cron examples unless you understand how to list and remove those jobs. Treat the Bot Token as a credential and keep it out of messages and logs.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
A messaging skill that sends to user-specified targets should clearly warn about misdelivery and sensitive-data exposure, but the high-level description emphasizes convenience and zero configuration without foregrounding that risk. In this context, accidental sending to the wrong Telegram ID can leak logs, task details, file paths, or status information to unintended recipients.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document claims the free version excludes scheduling, audit logs, media sending, and multi-target capabilities, but later examples reintroduce timed push and alternate targets. These contradictions can mislead agents and users about the true behavior surface, causing activation of features that were assumed unavailable or safe to ignore.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a narrowly scoped Telegram notification helper, but the capability section expands it into generic create/query/modify/delete, import/reset, and export/save/convert operations. That scope mismatch is dangerous because agents may grant this skill broader authority than users expect, increasing the chance of unintended file or state changes under the cover of a simple messaging skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are overly broad, including generic communication and notification scenarios, which can cause the skill to activate in contexts not specifically intended for Telegram messaging. In an agent environment, broad triggers increase the likelihood of accidental outbound messaging, possibly disclosing task details or personal data to Telegram recipients.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The cron example encourages persistent scheduled execution of agent-driven Telegram sends. Persistence increases risk because messages may continue to be sent automatically after context changes, and scheduled runs can repeatedly expose local file paths, task summaries, or other sensitive workflow data without fresh user review.
- Content
利用系统 cron 定时触发 Agent 发送消息，实现简单的定时推送。
bash # crontab -e # 每天早上 8:00 发送每日提醒 0 8 * * * /path/to/agent run "通过 telegram-agent-comm 发送消息：☀️ 早上好，今日待办事项已整理至 ~/todo/today.md"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill metadata and all user-facing documentation are presented entirely in Chinese, with no indication that another language can be selected. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Introducing save/export/convert behavior in a lightweight messaging skill broadens the effective trust boundary from message delivery to local data handling. Even if not directly exploitable on its own, it creates ambiguity that can lead an agent to write or transform local data unnecessarily, which is unrelated to the stated purpose and raises risk of accidental data exposure.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
L182-L184 states the free version does not provide audit logs and frames send-history viewing as unsupported. Yet L055-L061 advertises save/export operations and L186-L199 provides a built-in workflow pattern for recording send events locally, which contradicts the stronger implication that history/logging is outside free-version behavior rather than merely not natively managed by the skill.
- Content