Security audit

telegram-alert

Security checks across malware telemetry and agentic risk

Overview

This Telegram alerting skill mostly matches its stated purpose, but it requests broad read/write/exec authority and documents generic file and command capabilities that are not well scoped to notifications.

Install only if you are comfortable giving the agent authority to send messages to configured Telegram and other channels, store alert history, and potentially run local commands or custom scripts. Review configured chat IDs, webhooks, credentials, retention settings, and any command/script paths before use, and require explicit confirmation before sending sensitive or public messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document claims there are no untrusted external calls, but elsewhere explicitly enables custom scripts and system command execution. That contradiction can mislead users and downstream agents into over-trusting the skill's safety boundaries, increasing the chance that risky execution paths are invoked without proper review.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a Telegram alerting utility, but later advertises generic file processing and command execution capabilities unrelated to that purpose. Scope expansion like this increases attack surface and creates opportunities for the skill to be invoked in contexts where users do not expect local file access or shell-like behavior.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Documented system command execution is not justified by the stated purpose of sending Telegram and multi-channel alerts. In an agent setting, unnecessary exec capability materially raises the risk of command injection, local data access, persistence, and abuse of the host environment if later paired with user-controlled inputs or generated commands.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Advertising general file read/write handling exceeds what is reasonably necessary for a notification skill and broadens access to local data. In an agent environment, this can enable unintended exposure, modification, or staging of sensitive files under the guise of a benign alerting workflow.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger description is broad enough that normal user requests about messaging or notifications could activate the skill unintentionally. For a skill with outbound messaging, file access, and exec-adjacent behavior, accidental invocation can cause unreviewed data transmission or side effects in contexts the user did not clearly authorize.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The description does not prominently warn that content may be transmitted to external channels and stored in history/archives. Users may provide sensitive trading, personal, or operational data without understanding that it could be forwarded to Telegram, email, or other third parties and retained for long periods.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.