Telos

Fail

Audited by Snyk on Mar 5, 2026

Risk Level: CRITICAL
Full Analysis

CRITICAL E006: Malicious code pattern detected in skill scripts.

  • Malicious code pattern detected (high risk: 1.00). The package contains an explicit data-exfiltration pattern: the dashboard's chat API loads the user's entire Personal TELOS files (sensitive local data) and sends them unredacted to the external Anthropic model endpoint (using an API key), and the docs even mention a pre-configured/test API key — this is a deliberate high-risk data-leak and credential-exposure behavior (no obfuscated backdoor/RCE was found, but the external-AI call constitutes a clear privacy/exfiltration backdoor).
Audit Metadata
Risk Level
CRITICAL
Analyzed
Mar 5, 2026, 07:39 AM