The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file provides usage examples that encourage the agent to execute shell commands where user-controlled draft content is interpolated directly into command-line arguments (e.g., python3 ... --text "DRAFT_BODY_HERE"). This pattern is vulnerable to shell command injection if the draft content contains characters like backticks, semicolons, or subshell invocations.
[REMOTE_CODE_EXECUTION]: The script scripts/post.py dynamically alters the Python module search path (sys.path.insert(0, ...)) to import and execute code from an external directory (~/.claude/skills/telegram/scripts). This creates a dependency on external code that could be modified outside of the skill's own package, potentially leading to the execution of untrusted logic.
[DATA_EXFILTRATION]: The skill script reads content from a user's personal 'Vault' (located at ~/Brains/brain) and has the capability to send this data to external Telegram channels or users. This creates a surface for indirect data exfiltration if the agent is instructed to process a draft that contains sensitive information from other parts of the vault.
[DATA_EXPOSURE]: The skill requires access to sensitive Telegram session credentials and configuration files typically stored in ~/.telegram_dl/. Accessing these files across skill boundaries increases the risk of credential exposure.
[METADATA_POISONING]: The SKILL.md documentation contains contradictory information about its components. It explicitly states that scripts/post.py does not exist, even though the file is included in the skill's distribution. This deceptive instruction could be used to misdirect an agent's understanding of the code it is executing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted markdown data from a user's file system to be processed and sent via the Telegram API.
Ingestion points: Draft markdown files located in Channels/*/drafts/ within the vault directory.
Boundary markers: The script strips YAML frontmatter using regex markers (---), but does not provide explicit instructions to ignore embedded commands or instructions in the remaining body text.
Capability inventory: File system read/write/rename access within the vault; network communication via the Telegram API (Telethon library).
Sanitization: While the script converts markdown to HTML, it does not sanitize the content against prompt injection or validate that the target Telegram chat is authorized by the user.

telegram-post