Tg Cli

• Outcome: Review
• Latest audit: Nov 2, 2026 · 5:45 PM UTC
• Version: 1.0.2

Overview

Review before installing: its optional MCP connection can perform Telegram changes without enforcing the confirmation implied by an “ask” permission.

Prefer the CLI or a read-only MCP profile initially. Before enabling MCP writes, verify that the client actually requests approval for each change; an ask setting alone does not ensure this. Restrict history downloads to authorized chats and periods, and disable unused administrative capabilities. Scanner alarms about theft and hidden persistence were unsupported, but the external executable package was not included for review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (15)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Most chat discovery, message retrieval, attachment download, and transcription commands support the declared Telegram purpose. However, the task commands introduce a distinct workflow-management capability, including state-changing operations. The tg personal search all command also accesses notes and Drive documents, resources outside the declared Telegram scope. Requiring the owner's request or approval for some operations does not make those capabilities declared. The supplied chunk is command documentation, so this finding concerns the capabilities it exposes rather than evidence that these commands have already executed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The chunk primarily manages contact annotations and chat classification rather than Telegram setup or messaging. Metadata retrieval and synchronization can support finding or reading conversations, but the commands that mutate notes, aliases, and tags introduce persistent account-management capabilities not disclosed in the description. The code stays within Telegram-related resources and shows no unrelated external access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

Message searching and inspecting mentions could support the declared Telegram-reading functionality. However, rebuilding an extracted-mentions index and explicitly confirming an organization association introduce data-maintenance and entity-classification operations not represented by the description. These commands go beyond merely finding or reading conversations.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

## Telegram drafts

`tg personal messages send CHAT "text" --draft` saves a draft for the owner to review and send in Telegram.
It replaces any existing draft in that chat/topic, so confirm the intended replacement when needed.
It sends no message and uses the separate `drafts` permission. Formatting, `--reply-to`, `--topic` and
`--no-preview` work; empty text, attachments, scheduling and other send-only flags are refused.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

printed, paste it and say the old one expired. With `--json` each code is also a stderr line
`{"event":"qr","qr":{"text","expires_at","scan"}}`. Login is not an MCP tool: with only MCP, ask
the owner to run the command in a terminal or to sign in from WireCat Desktop (Tools → Telegram → Manage).
Existing sessions are checked without a new login. Missing keyring access
requires fixing the environment, not another login. Pick a chat and an amount of history with
the owner before `tg personal messages sync <chat> --last 100`; setup starts no background service.

L355–L364 introduce group upgrades and permanent deletion of entire forum topics.

High

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

Enabling topics can upgrade a basic group and change its chat ID, while deleting a topic permanently deletes every message in it for everyone. These administrative and destructive operations go beyond the manifest's setup, lookup, reading, and message-sending purpose; explicit authorization safeguards do not resolve that scope mismatch.

Content

No source excerpt is available for this finding.

L378–L387 expose the full Telegram Bot API, including financial operations and managed-bot credential replacement.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest scopes the skill to the owner's personal Telegram account, while these commands operate bot identities and expose financial and credential-management capabilities. These are not implementation requirements for connecting a personal account or reading and sending its messages, even though individual methods have permission checks.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

Reply controls: `tg personal replies add|edit|on|off` edit local rules; `replies audience` controls file-level
allow/deny lists (deny wins). `test` previews stored messages without sending; `status`, `pause` and
`resume` control the profile's rules. Liquid reads sender/chat facts only; incoming text goes to a
model only inside ai blocks. Ordinary previews show instruction/fallback with no model call;
`test --ai` explicitly uses a consented provider. `replies consents grant|revoke` controls profile/
endpoint consent and `deny|allow` controls native chat opt-outs. Never widen the audience or run live
scenarios without the owner's separate consent. Shared `serve` replies to everyone a rule matches unless the audience limits it, and only with explicit

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

use the one-call installer from the installation guide: it repairs user and current-shell PATH,
installs the skill even with disabled lifecycle scripts and verifies bare `tg`. Read `tg skill show`
and verify your skill is loaded before login. If your process predates installation, refresh your
shell PATH from the user/machine environment yourself; do not ask the user to edit PATH.

## Telegram drafts

L178–L180 expand Telegram message search to private notes and imported Google Drive documents.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest describes finding people and chats and reading or sending Telegram messages, but search all also retrieves notes and imported Drive documents. Requiring an explicit owner request limits accidental access but does not make these additional data sources part of the manifest's declared scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The documented MCP behavior delegates confirmation entirely to the client while permitting writes under an ask permission. Telling the owner to enable client approval does not establish that approval is active, leaving an authorization gap where an agent can perform changes without the confirmation the profile setting appears to require.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

An agent without a terminal (Claude Desktop, Cursor) uses the MCP server instead: `tg personal mcp serve`. The
profile's `permissions` decide which commands may run, through `tg_tools_search`, `tg_read` and
`tg_write`. Discovery keeps denied commands and their arguments, marking current unavailability
with a reason and permission key. There is no confirmation form: approval for a write is the MCP client's, so ask
the owner to turn it on. `tg personal mcp config` prints the entry with full paths.

`tg <bot> bot me` reads the bot identity (id, name and username); it needs a token and refuses `--offline`. MCP offers `tg_bot_read` (`command: "me"`).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

This passage explicitly states that MCP treats ask and allow alike for writes, making client approval the only confirmation barrier. Owner-code login authenticates access but does not approve individual operations, so an authenticated agent with an approval-disabled client could execute writes under a nominally confirmation-required policy.

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

md

Use `tg personal stats chats show <chat> --offline --json` for stored group/channel activity. The online command also
requests joins/leaves; MCP and offline results omit `members`. Incomplete counts are lower bounds.
`tg personal mcp serve --http --public-url https://<name>.ts.net` serves behind your tunnel with its own owner-code login;
MCP has no server forms. `deny`/`readonly` block writes; `ask`/`allow` permit the requested write without asking,
so the client's approval is the only prompt.
Repeat `--permission key=level` to tighten permissions for the server; it never loosens them. Never change permissions to bypass a refusal.
`tg personal mcp revoke` forgets browser logins for the profile.

Picture-search instructions mandate English queries without explicit language opt-in or a documented justification.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The skill states that picture queries must be English and instructs the agent to translate the owner's words first. Although enabling picture search requires permission, that permission does not explicitly establish consent to the language restriction, and the text does not explain why English is required.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 529)May include surrounding context.

md

changing the chat. Dry-run uses cached data only and cannot be combined with refresh. Limit is
bounded at 500 chats. A rule score is not a probability. Automatic claims are separate from manual
labels; rerunning preserves manual labels. Without `--claim`, removing a label removes both claims.
A later explicit auto run can regenerate it. Linking identities never silently combines private notes.

Phones, e-mail addresses, links and Google documents written in stored messages are kept as mentions, found
by rules on every store write. `mentions list` takes a query: `kind:phone|email|url|document`,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 564)May include surrounding context.

md

`stats contacts responses --answerer <person>`. Known-join newcomer help is `stats chats newcomers <chat>`;
viewed posts with little stored discussion are `stats messages discussion`. Inspect graph/archive
quality and use each row’s exact `selection` with `--component report`; missing history/join dates
are not zero. All four reports read stored data; do not infer historical administrator roles.


Remote agents can request retained bytes: discover attachments show through tg_tools_search

Static analysis

No suspicious patterns detected.