Security audit

Telegram Agent Comm Free

Security checks across malware telemetry and agentic risk

Overview

This is a Telegram notification skill with expected outbound messaging behavior, but users should configure credentials and recipients carefully.

Install only if you want your agent to send Telegram text notifications. Store the bot token securely, verify the Telegram target ID before use, and avoid sending secrets, private logs, or sensitive work details in messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough that the skill may activate for generic requests about notifications, communications, or integrations, increasing the chance of unintended use. In an agentic environment with exec enabled and networked message delivery, ambiguous activation can lead to accidental outbound messages, disclosure of task details, or misuse of configured Telegram credentials.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill requires a Telegram Bot Token and sends user-supplied content over the network, but it does not provide a clear security warning about secret handling, recipient verification, and possible exposure of sensitive data in messages or logs. This omission can cause users to store tokens insecurely, paste secrets into prompts, or transmit internal paths, reports, and operational details to unintended recipients.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.