Security audit
Security checks for vulnerabilities and agentic risk
This Telegram skill is mostly documentation, but it asks for broad read/write/command authority and describes generic automation capabilities without clear limits or consent controls.
Review before installing. Use this only when you intentionally want an agent to manage Telegram-related bot/chat tasks, and do not allow shell commands, file writes, or outbound API calls unless you have reviewed the exact action and the Telegram bot token/chat scope being used.
The skill description is overly broad and mixes unrelated use cases such as project management, workflow automation, and generic Telegram functionality. In an agent ecosystem, vague triggering criteria can cause the skill to be selected in contexts where users did not intend Telegram actions, increasing the chance of unnecessary external communication or tool use.
The skill advertises file handling, API integration, information retrieval, and command execution, but does not present prominent user-facing warnings or consent requirements for these sensitive capabilities. This can mislead users and downstream agents into invoking operations that write files, execute commands, or contact external services without clear disclosure or approval.
No suspicious patterns detected.
