tg-responder
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the subprocess module to execute local scripts and CLI tools. While these calls use argument lists rather than shell strings, they represent an internal execution surface. Evidence includes worker.py and follow_ups.py invoking the claude CLI and sibling scripts like tg_draft.py and telegram_fetch.py to process messages, and lookup_chat.py passing user-supplied search queries as arguments to a utility script.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted message text from Telegram, creating a surface for indirect prompt injection. 1. Ingestion points: Untrusted data enters through backfill.py and hook.py from the Telegram API. 2. Boundary markers: prompts/classify.md instructs the LLM to treat message text as data only and ignore embedded commands. 3. Capability inventory: The system can write to a local database, send messages via external scripts, and set native Telegram drafts. 4. Sanitization: worker.py implements character filtering and uses json.dumps to escape untrusted data before interpolation into the classification prompt.
Audit Metadata