bot-process-control
Warn
Audited by Snyk on Mar 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly notes a "single long-poll connection to Telegram API" and lists Telegram Commands (e.g., /compose, /reply) that the bot reads and acts on, so untrusted user-generated Telegram messages are ingested and can directly drive actions (send emails), enabling indirect prompt-injection risk.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt instructs the agent to create/load/unload launchd plists, start/stop/restart daemons, kill processes, and delete token and PID files — all actions that modify the host's runtime and credential state (persistence and credentials) even though they don't require sudo.
Audit Metadata