telegram-bot
Fail
Audited by Snyk on Sep 5, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for a Telegram bot token and provides a fallback command where the token is embedded directly in an environment variable prefix (
TELEGRAM_BOT_TOKEN=<token> npm run setup), which exposes the secret in the LLM's context and command execution history.
Issues (1)
W007
HIGHInsecure credential handling detected in skill instructions.
Audit Metadata