Telegram Mini App Security Auditor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.3

Overview

This is a disclosed local Telegram Mini App security auditor that scans a user-chosen project and writes local reports, with no evidence of hidden execution or data exfiltration.

Install only if you are comfortable letting it read the Telegram Mini App project you point it at, including local config files such as .env. Store the generated audit reports somewhere private because evidence snippets may include token-like or secret-like text from the scanned project.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

".cfg",
    ".conf",
    ".css",
    ".env",
    ".example",
    ".html",
    ".ini",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs the operator to run a local Python auditing script against arbitrary project paths and to write results to an output directory, and it also references a follow-up external scanning command. However, the manifest does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, this mismatch can cause overbroad default access or make reviewers unable to verify what file and network capabilities the skill actually needs, increasing the risk of unintended file access, file creation, or external connectivity.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This Python code performs file writes via write_text() to user-specified output paths. Although the CLI arguments imply output generation, there is no confirmation prompt or explicit warning comment/docstring near the write operations describing that files will be created or overwritten.

Static analysis

No suspicious patterns detected.