telegram
Fail
Audited by Snyk on Mar 6, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes a troubleshooting step that explicitly embeds the Telegram bot token into a curl URL (https://api.telegram.org/bot/getMe), which would require inserting the secret verbatim into generated commands and thus creates an exfiltration risk.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes a /kill command that “disables launchd service + kills process,” which is a destructive, system-level action that changes the machine's service state (i.e., modifies system state/daemon control).
Audit Metadata