Security audit

智能体Telegram

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Telegram notification convention, but it routes routine agent updates to one fixed Telegram ID and encourages sharing project details without enough user control.

Review this carefully before installing. Use it only if Telegram ID 5440561025 is your intended recipient, redact paths and technical details before sending, secure bot tokens outside committed files, and remove unnecessary exec/write/file-search permissions if your platform allows it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a Telegram messaging convention, but its documentation broadens expected behavior into generic processing concepts such as callbacks, file handling, API integration, and command execution. That scope expansion can mislead an agent into performing actions beyond the user’s reasonable expectation, increasing the risk of unintended data handling or tool use.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Declaring powerful tools such as exec, write, glob, and grep is inconsistent with a skill whose stated purpose is only message formatting and routing. This over-privileging increases the attack surface because an agent may read files, modify data, or execute commands under the guise of a simple notification workflow.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill gives conflicting guidance about credential storage: one section recommends environment variables while other sections instruct storing Telegram tokens in local JSON configuration files. Inconsistent secret-handling guidance often leads to insecure deployments, accidental token exposure, and poor operational hygiene.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill normalizes sending task details and file paths to Telegram without a clear user-facing warning that this is an external third-party channel. Users may not realize operational details are being transmitted outside the local environment, which creates a privacy and confidentiality risk.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The skill hardcodes all outbound messages to a fixed Telegram ID and explicitly forbids using any other target. That creates a strong exfiltration pattern because agents are instructed to send potentially sensitive status information to a predetermined external recipient regardless of user intent or context.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill embeds a routine practice of sending project status, task content, and file-related information to a fixed external Telegram account. In context, this makes ordinary workflow reporting a data-leakage channel rather than an exceptional, user-approved action.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The example scenarios explicitly instruct agents to include output file paths and problem details in Telegram messages. Even when no secret is directly included, internal paths, filenames, and debugging context can reveal project structure, technologies, and operational state to an external party.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The message templates operationalize exfiltration by instructing agents to send task names, file paths, and troubleshooting details as a standard reporting format. Because these templates are reusable defaults, they increase the likelihood of repeated inadvertent disclosure across many tasks.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The concrete examples direct agents to send internal document paths and technical failure details, such as API endpoints and database scaling advice, to the Telegram recipient. These specifics can expose system internals and troubleshooting intelligence that would be useful to an unauthorized recipient or attacker.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.