telecrawl
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands via the
telecrawlCLI to manage database states and imports. - Evidence:
telecrawl import,telecrawl --json chats, andtelecrawl doctor. - [COMMAND_EXECUTION]: The skill provides instructions to perform remote command execution using SSH targeting a specific host and user.
- Evidence:
ssh -o RequestTTY=no -o RemoteCommand=none steipete@clawmac 'zsh -lc "telecrawl --json status"' - [DATA_EXFILTRATION]: The skill accesses sensitive personal communication data, including Telegram chats, messages, folders, and contacts stored in local application directories and databases.
- Evidence: Accessing
~/.telecrawl/telecrawl.dband the Telegram Desktoptdataor macOS Postbox source. - [DATA_EXFILTRATION]: The skill includes functionality to push encrypted data shards to a remote Git repository, representing a potential exfiltration path for communication history.
- Evidence: The
telecrawl backup pushcommand.
Audit Metadata