Security audit
Security checks for vulnerabilities and agentic risk
This skill gives visible instructions for finding public Telegram links by web search, with no hidden execution, persistence, or credential access.
Use this only for lawful, public community discovery, and treat Telegram links as unverified. Avoid requests involving scams, evasion, illegal markets, stolen data, or other harmful communities.
The declared description promises a functional skill for locating Telegram communities by topic via web search/fetch. However, the actual code chunk does not implement any of that behavior. It only prints a placeholder message and includes comments indicating that real logic is yet to be added. This is a material mismatch in primary purpose and implemented capability.
The invocation scope is broad enough that the skill could activate for generic requests to find Telegram communities, including requests that facilitate access to risky, fraudulent, or illicit groups. Because Telegram discovery can be used for outreach into scam, payment, or underground channels, overbroad triggering increases the chance of unsafe assistance without sufficient user-intent checks.
The skill encourages discovery of Telegram groups but provides no warning or screening for privacy, safety, scams, or illicit-community risks. In this context, the omission matters because users may be directed toward communities that expose them to fraud, malware, doxxing, or illegal marketplaces, especially given the example topic involving payment channels.
The quick start directs use of a query in Chinese or English as appropriate, which imposes a language assumption in the workflow rather than explicitly centering user choice. While mild, this can conflict with a language/locale policy if the skill should avoid steering language without opt-in.
No suspicious patterns detected.
