telegram-draft-for-review

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a defensive security component that enforces manual human review (👍/❌) for all outbound messages, significantly reducing the risk of autonomous AI errors or malicious outbound communication.
  • [SAFE]: Implements robust local auditing by appending all draft states and status transitions to .harness/swarm.jsonl and maintaining message state in .harness/telegram_drafts.jsonl.
  • [SAFE]: Includes a functional safety kill-switch via the TAO_SWARM_ENABLED environment variable, ensuring that message sending can be halted at the boundary even if a draft is approved.
  • [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it accepts and processes arbitrary text from a caller payload. However, this is neutralized by the human review step.
  • Ingestion points: Ingests untrusted content via the draft_text field in the input JSON payload.
  • Boundary markers: Missing programmatic boundary markers for the draft content, relying instead on visual formatting for the human reviewer.
  • Capability inventory: Invokes the swarm/telegram_alerts.py script for approved sends, writes to local .harness/ JSONL files, and communicates with the Telegram API.
  • Sanitization: Primary sanitization is achieved through mandatory human-in-the-loop approval; PII redaction is noted as a planned Wave 2 feature.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 01:13 PM
Security Audit — agent-trust-hub — telegram-draft-for-review