telegram-draft-for-review
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a defensive security component that enforces manual human review (👍/❌) for all outbound messages, significantly reducing the risk of autonomous AI errors or malicious outbound communication.
- [SAFE]: Implements robust local auditing by appending all draft states and status transitions to
.harness/swarm.jsonland maintaining message state in.harness/telegram_drafts.jsonl. - [SAFE]: Includes a functional safety kill-switch via the
TAO_SWARM_ENABLEDenvironment variable, ensuring that message sending can be halted at the boundary even if a draft is approved. - [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it accepts and processes arbitrary text from a caller payload. However, this is neutralized by the human review step.
- Ingestion points: Ingests untrusted content via the
draft_textfield in the input JSON payload. - Boundary markers: Missing programmatic boundary markers for the draft content, relying instead on visual formatting for the human reviewer.
- Capability inventory: Invokes the
swarm/telegram_alerts.pyscript for approved sends, writes to local.harness/JSONL files, and communicates with the Telegram API. - Sanitization: Primary sanitization is achieved through mandatory human-in-the-loop approval; PII redaction is noted as a planned Wave 2 feature.
Audit Metadata