The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The installation guide explicitly instructs users to run 'setup.exe' or 'tool.exe' as Administrator. This grants the application unrestricted access to the host operating system, which is unnecessary for a Telegram statistics bot.
[REMOTE_CODE_EXECUTION]: The skill encourages users to download and execute binary files from a repository that is not affiliated with a trusted organization. The instructions to extract a package using a password ('trainer2026') is a classic indicator of malware distribution intended to evade antivirus and automated sandboxing detection.
[EXTERNAL_DOWNLOADS]: The skill references a GitHub repository ('github.com/ddperso/Telegram_Group_Statistics___Analytics_Bot.git') which is not a verified or well-known service for this type of application, increasing the risk of supply chain attack or malicious payload delivery.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted message data and usernames from Telegram groups, which could lead to injection attacks if the output is processed by other agents or users.
Ingestion points: Data enters the system via the track_message, track_member_join, and track_member_leave handlers in SKILL.md.
Boundary markers: No boundary markers or 'ignore' instructions are used when handling external message content or usernames.
Capability inventory: The skill possesses the capability to write to a local database (SQLAlchemy), generate PDF reports (ReportLab), and export CSV files.
Sanitization: There is no evidence of sanitization or escaping of external content before it is stored in the database or rendered into reports.

telegram-group-statistics-analytics-bot