telegram-bot-conflict-resolution

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The procedure explicitly instructs extracting bot tokens and swapping them into Hermes .env (and checking services using the same bot token), which requires the agent to read and place secret token values verbatim into configuration files/commands, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.85). The procedure describes setting up redundant Telegram-based control channels for VPS agents, token swapping and deliberate hiding of API keys (avoid process table), and checks for "ghost pollers" — patterns consistent with covert remote-control/backdoor maintenance and credential misuse, so this is high-risk for abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The instructions explicitly tell the agent to stop LaunchAgents, create/modify systemd unit files and crons, rsync/patch system paths, and run systemctl checks—actions that modify system services/state and require elevated privileges.