The Agent Skills Directory

[DATA_EXFILTRATION]: The file command in scripts/telegram.sh (line 155) allows the agent to send any local file to the Telegram Bot API via curl. Since the skill does not implement a whitelist or directory restrictions for the file path, it creates a surface where sensitive data (such as SSH keys or configuration secrets) could be exfiltrated if the agent is misdirected.
[COMMAND_EXECUTION]: The script relies on shell execution of curl and jq (lines 81-88) to process API requests. While these operations target a well-known service (Telegram), the dynamic construction of command arguments from agent-provided input presents a potential surface for command parameter manipulation.
[PROMPT_INJECTION]: The skill possesses an Indirect Prompt Injection surface via incoming Telegram messages.
Ingestion points: Incoming message text is ingested via the getUpdates API method in the read (line 207) and ask (line 269) commands.
Boundary markers: The script does not apply delimiters or clear boundary markers to the incoming text before it is returned to the agent.
Capability inventory: The skill has significant capabilities including file system access and network transmission.
Sanitization: The script implements a chat ID filter (allowed_chats, line 173) to ensure messages are only processed from authorized users, which serves as a primary access control mechanism but does not analyze the content for malicious instructions.

telegram-bot-messaging