Security audit

Tristan RFQ overseer

Security checks for vulnerabilities and agentic risk

Overview

This RFQ assistant is not clearly malicious, but it needs review because Telegram commands can expose or change sensitive procurement records without documented sender controls.

Review before installing. Use only with a private Telegram bot or chat, enforce sender and chat allowlists outside the skill, constrain Obsidian access to the intended vault folders, and dry-run pricing or quote changes before enabling write-back or email delivery.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/telegram-conventions.md:5
Finding: Telegram Commands Do Not Enforce Sender Authorization
Content: View full analysis
` | Create a new RFQ note in `intake` status. Reply with the vault link and generated `rfq_id`. | | `/price RFQ-XXXX` | Run `scripts/pricing_model.py --write` against that note. Reply with the computed total. | | `/compare RFQ-XXXX` | Run `scripts/compare_quotes.py` against `Quotes/RFQ-XXXX/`. Reply with the ranked markdown table. | | `/status RFQ-XXXX` | Reply with the current status, due date, and total from the note's frontmatter. | ``` The corresponding Skill triggers also define these operations without requiring an authenticated sender: ```markdown | `wake.phrase` | `"T, we live?"` | Reply as Tristan with a status summary of all open RFQs (status ≠ `closed`). | | `email.received` | Subject/body contains "RFQ" or "Quotation" | Create RFQ note from `assets/rfq-note-template.md` → notify via Telegram: `New RFQ: [ID]`. | | `telegram.message` | Starts with `/rfq` | Create RFQ note → reply with the vault link. | | `command.run_pricing` | `/price RFQ-XXXX` | Run `scripts/pricing_model.py` on that note → update `Pricing` section. | | `command.pricing_strategy` | `/strategy RFQ-XXXX ` | Run `scripts/pricing_strategies.py report` → update `Pricing Strategy Comparison` section. | | `command.compare_quotes` | `/compare RFQ-XXXX [--tco]` | Run `scripts/compare_quotes.py` → stage a ranked draft. Add `--tco` for long-term/capital RFQs. | ``` ### Technical Analysis The Telegram channel is described as “internal,” but the Skill does not define an enforceable authorization boundary. There ...[truncated 2030 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pricing_model.py:78
Finding: Unvalidated Financial and Computational Inputs Can Corrupt Pricing or Exhaust Resources
Content: View full analysis
dict: """tiers: list of {"min_qty": int, "discount": float} sorted asce ...[truncated 5954 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad end-to-end RFQ automation skill with multiple intake channels, storage, pricing, comparison, drafting, and trigger mechanisms. The supplied code chunk implements only one narrow stage: supplier quote comparison/ranking from existing local JSON files. It does not contain logic for email or Telegram intake, Obsidian integration, wake phrase handling, command triggers, or drafting outbound confirmations. While quote comparison is part of the declared pipeline, the actual code’s primary purpose is much narrower than the declared skill behavior, so this is a clear description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims a broad, end-to-end RFQ workflow with multiple ingestion channels and actions (email, Telegram, comparison, drafting, wake phrase triggers). The code provided only implements one narrow component: pricing calculation for an existing markdown RFQ note. It does not process email or Telegram messages, does not implement any trigger handling, does not compare supplier quotes, and does not draft outbound confirmations. While reading and optionally updating an Obsidian-style markdown note is consistent with part of the description, the actual code is materially narrower than the declared purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad RFQ automation skill with messaging triggers, intake channels, storage/orchestration, comparison, and drafting functionality. The supplied code chunk is much narrower: it provides pricing strategy calculations (market, value, volume, target, escalation, TCO), a report renderer, and optional write-back to a local note file. It does not implement email/Telegram ingestion, trigger processing, supplier quote comparison across vendors, outbound draft generation, or general RFQ pipeline orchestration. While pricing calculation and note write-back align partially with the description, the code materially underdelivers versus the declared end-to-end purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises file read/write behavior through an Obsidian vault workflow but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the runtime grant broader filesystem access than intended, increasing the risk of unauthorized reads or modification of procurement records and adjacent files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is designed to move RFQ data through email and Telegram, both external communication channels, but it provides no user-facing warning or consent language about transmitting potentially sensitive commercial information. In procurement contexts, RFQs often contain pricing, supplier identities, and customer requirements, so silent transmission can cause confidentiality breaches, policy violations, or accidental disclosure to the wrong recipients.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This Python file performs a file write back to the user-supplied note when --write is set, but there is no confirmation prompt before modifying the file. Although the module includes a helper name and a post-write stderr message, the execution path that changes the file lacks an explicit user-facing warning immediately before the write occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.