search-messages

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECREDENTIALS_UNSAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill accesses sensitive Telegram session data stored in ~/.local/share/telethon/. This access is expected as it is necessary for the skill's primary function of searching Telegram messages.\n- [PROMPT_INJECTION]: The skill processes third-party Telegram message content, which is a surface for indirect prompt injection where malicious message content could attempt to influence agent behavior.\n
  • Ingestion points: Message text retrieved from Telegram chats via the tg-cli.py script.\n
  • Boundary markers: Output is structured with metadata, but the file does not specify delimiters or instructions to ignore instructions embedded within the messages.\n
  • Capability inventory: The agent can use Bash, Read, Grep, and Glob tools, which are powerful but restricted to the execution environment.\n
  • Sanitization: No sanitization of the retrieved message content is specified before it is presented to the agent.\n- [COMMAND_EXECUTION]: The skill executes a local Python script using the uv tool via a Bash wrapper. It passes user-provided search queries directly to the command line as arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 09:31 PM
Security Audit — agent-trust-hub — search-messages