The Agent Skills Directory

[COMMAND_EXECUTION]: The listen command implementation in tg_cli.py (and the bin/tg symlink) includes an --exec option that allows the execution of arbitrary shell commands. It uses subprocess.Popen with shell=True, which poses a significant risk as it allows for the execution of arbitrary system commands on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (Telegram messages) and provides the agent with powerful capabilities like sending messages, downloading files, and executing shell commands. This creates a surface where malicious message content could potentially influence the agent to perform unintended actions.
Ingestion points: Telegram messages are ingested via the read, folder, search, and listen commands in tg_cli.py.
Boundary markers: No explicit boundary markers or instructions to treat message content as untrusted were found in the skill's instructions.
Capability inventory: The skill can write files (tg download), send messages (tg send), and execute shell commands (tg listen --exec).
Sanitization: No evidence of sanitization or escaping of external message content was found before it is processed or displayed.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive Telegram authentication data, including session files (~/.config/tg-cli/session.session) and API credentials (~/.config/tg-cli/config.json). These files grant full, persistent access to the user's Telegram account. While the skill correctly sets file permissions to chmod 600, these remain high-value targets for local attacks.
[EXTERNAL_DOWNLOADS]: The skill relies on and recommends the installation of transcribe-cli, an external tool for audio transcription. If the --transcribe flag is used, the skill will attempt to execute the transcribe binary from the system's PATH or a local directory.

tg-cli