Oathe Security Badge

Is sanwecn/telegram-voice-group safe?

https://github.com/sanwecn/telegram-voice-group

88
SAFE

This skill provides legitimate Telegram voice messaging functionality using text-to-speech conversion. While some sensitive files were accessed during installation, this was attributed to normal system authentication processes rather than the skill itself.

Category Scores

Prompt Injection 95/100 · 30%
Data Exfiltration 80/100 · 25%
Code Execution 85/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 90/100 · 10%
Behavioral Reasoning 90/100 · 5%

Findings (3)

MEDIUM Sensitive file access detected -20 ▶

During installation, sensitive files like .env, SSH keys, and AWS credentials were accessed. However, analysis shows these accesses were from system authentication processes during SSH login, not from the skill code itself.

LOW External dependencies required -15 ▶

The skill requires edge-tts and ffmpeg binaries to function, which need to be installed separately. These are legitimate tools for text-to-speech and audio conversion.

INFO Automated messaging capability -10 ▶

This skill can send automated voice messages to Telegram groups, which could potentially be used for spam if misused. However, the functionality is clearly documented and legitimate.