tg-cli
Enables read-only access to Telegram data via CLI, allowing users to list chats, fetch messages, and download media securely.
Install this skill
or
21/100
Security score
The tg-cli skill was audited on Jun 6, 2026 and we found 11 security issues across 3 threat categories, including 4 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
medium line 30
Access to hidden dotfiles in home directory
SourceSKILL.md
| 30 | - read/write: ~/.tg-mtproto-cli/sessions/*.session (SQLite auth sessions) |
medium line 73
Access to hidden dotfiles in home directory
SourceSKILL.md
| 73 | | Session files | Read/write `~/.tg-mtproto-cli/sessions/*.session` | SQLite databases with auth keys; created by `tg auth` | |
medium line 81
Access to hidden dotfiles in home directory
SourceSKILL.md
| 81 | - Session files contain sensitive auth material — do not read, copy, or expose `~/.tg-mtproto-cli/sessions/` contents. |
high line 22
Access to system keychain/keyring
SourceSKILL.md
| 22 | storage: system keychain (macOS Keychain / Windows Credential Vault / Linux Secret Service) |
high line 32
Access to system keychain/keyring
SourceSKILL.md
| 32 | keychain: read/write account metadata and API credentials |
high line 63
Access to system keychain/keyring
SourceSKILL.md
| 63 | | Telegram `api_id` + `api_hash` | [my.telegram.org/apps](https://my.telegram.org/apps) | System keychain (macOS Keychain / Windows Credential Vault / Linux Secret Service) | |
high line 74
Access to system keychain/keyring
SourceSKILL.md
| 74 | | System keychain | Read/write | Stores `api_id`, `api_hash`, account metadata, default account | |
low line 13
External URL reference
SourceSKILL.md
| 13 | registry: https://www.npmjs.com/package/tg-mtproto-cli |
low line 21
External URL reference
SourceSKILL.md
| 21 | obtain: https://my.telegram.org/apps |
low line 49
External URL reference
SourceSKILL.md
| 49 | - npm: [npmjs.com/package/tg-mtproto-cli](https://www.npmjs.com/package/tg-mtproto-cli) |
low line 63
External URL reference
SourceSKILL.md
| 63 | | Telegram `api_id` + `api_hash` | [my.telegram.org/apps](https://my.telegram.org/apps) | System keychain (macOS Keychain / Windows Credential Vault / Linux Secret Service) | |
Scanned on Jun 6, 2026
View Security Dashboard