tg
Verdict safe, but 2 findings (2 medium), mainly data exfiltration. Most recent scan 2026-02-07.
This Telegram CLI skill presents MODERATE security risks primarily related to data access and credential management. The skill provides legitimate functionality for interacting with Telegram via a third-party CLI tool (@cyberdrk/tg), but lacks important security safeguards. Key concerns include: (1) No guidance on secure credential storage for Telegram API tokens, (2) Unrestricted access to all user Telegram data without access controls, (3) Missing security documentation about the implications of granting API access, (4) Hardcoded developer paths that expose unnecessary information. The skill does not contain malicious code, prompt injection attempts, or data exfiltration mechanisms. However, the broad data access capabilities combined with insufficient security guidance create risks if the agent or user environment is compromised. The skill would benefit from adding security warnings, implementing access controls, and providing clear documentation about credential management.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Telegram CLI for reading, searching, and sending messages. Use when the user asks about Telegram messages, wants to check inbox, search chats, send messages, or look up contacts and groups.
- Package
- 2 files, 5.5 KB
- SKILL.md
- 377 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Telegram CLI · When to Use · Install · Authentication · Commands · Reading · Writing · Contacts & Groups · Status · Output Formats · Examples · Notes
Findings
MEDIUM Telegram API Credentials Required Without Security Guidance Data Exfiltrationllm
The skill requires users to obtain Telegram API credentials from my.telegram.org/apps and authenticate via 'tg auth' command, but provides no security guidance on credential storage, session management, or the security implications of granting API access. The underlying CLI tool will store authentication tokens locally, creating potential credential exposure risks if not properly secured.
SKILL.md
First-time setup requires API credentials from https://my.telegram.org/apps
```bash
tg auth
```MEDIUM Unrestricted Access to Sensitive Telegram Data Data Exfiltrationllm
The skill provides broad access to read all Telegram messages, contacts, group memberships, and admin status without any access controls or data minimization principles. Commands like 'tg inbox', 'tg chats', 'tg read', and 'tg search --all' can access the user's entire Telegram history. While this matches the stated functionality, there are no safeguards against over-collection or unauthorized access if the agent is compromised.
SKILL.md
tg inbox # Unread messages summary
tg chats # List all chats
tg read "ChatName" -n 50 # Read last 50 messages
tg search "query" --all # Search all chatsWhat is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 2.8 KB |
SKILL.md | doc | 2.7 KB |
External hosts referenced
my.telegram.org github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/tg
- Raw scan result: telegram-cli-scan.json
- Badge for your README:
- Request a re-scan