mtgo-mtproto-go
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The library invokes the
ffmpegsystem utility intelegram/ffmpeg_pipe.goto facilitate multimedia broadcasting. The command is constructed using a slice of arguments, which is a safe practice that prevents shell-based command injection. - [PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it processes untrusted messages from the Telegram API. Ingestion points: Update handling logic in
telegram/client.go. Boundary markers: None; the library provides raw message text and entities to the application layer. Capability inventory: Significant capabilities including chat administration, message deletion, and media streaming viaffmpeg. Sanitization: Incoming data is structured into TL types, but natural language instructions from users are not filtered by the library. - [SAFE]: The project structure, license, and external dependencies are standard for a Go-based API client. The
go.modfile contains a future version number (1.26.2), which is likely a non-malicious configuration placeholder or error.
Audit Metadata