telecrawl

Warn

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands via the telecrawl CLI to manage database states and imports.
  • Evidence: telecrawl import, telecrawl --json chats, and telecrawl doctor.
  • [COMMAND_EXECUTION]: The skill provides instructions to perform remote command execution using SSH targeting a specific host and user.
  • Evidence: ssh -o RequestTTY=no -o RemoteCommand=none steipete@clawmac 'zsh -lc "telecrawl --json status"'
  • [DATA_EXFILTRATION]: The skill accesses sensitive personal communication data, including Telegram chats, messages, folders, and contacts stored in local application directories and databases.
  • Evidence: Accessing ~/.telecrawl/telecrawl.db and the Telegram Desktop tdata or macOS Postbox source.
  • [DATA_EXFILTRATION]: The skill includes functionality to push encrypted data shards to a remote Git repository, representing a potential exfiltration path for communication history.
  • Evidence: The telecrawl backup push command.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 7, 2026, 12:39 PM
Security Audit — agent-trust-hub — telecrawl