AI assistant in Telegram that remembers everything and helps you run your life. Self-hosted in one command.
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 3d ago · see ecosystem CVEs →
- D · 76 → D · 64
- D · 69 → D · 76
- C · 41 → D · 69
- D · 68 → C · 41
- B · 32 → D · 68
- A · 0 → B · 32
No known CVEs for this server.
- high dangerous code
obfuscated payload: dynamic require()/import()
- low dangerous code
env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke
- low dangerous code
env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke
- low dangerous code
env-secret-flows-to-network-js: A process environment value reaches a network call. Review whether it is a credential leaving the process; the ordinary API-wrapper shape (read a ke
analyzed commit f5bb315 · analyzer v33 · 4d ago
skills & prompt files 7
- skill smixs-iva-agent-f5bb315/agent/skills/agent-browser/SKILL.md
- skill smixs-iva-agent-f5bb315/agent/skills/rich-post/SKILL.md
- skill smixs-iva-agent-f5bb315/agent/skills/security-defense/SKILL.md
- skill smixs-iva-agent-f5bb315/agent/skills/telegram-userbot/SKILL.md
- skill smixs-iva-agent-f5bb315/agent/skills/update-recovery/SKILL.md
- skill smixs-iva-agent-f5bb315/scripts/autograph/docs/SKILL.md
- skill smixs-iva-agent-f5bb315/scripts/memory/instructions/memory-processor/SKILL.md
danger signals13
- suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/agent/lib/error-humanizer.test.ts :129
"Request URL https://api.telegram.org/bot123456:secret-token/getMe failed", - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/agent/lib/telegram-media.ts :71
`https://api.telegram.org/file/bot${token}/${filePath}`, - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/fixtures/telegram-main-guard-child.ts :25
if (!target.startsWith("https://api.telegram.org/")) { - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/lib/telegram-send.test.ts :57
"https://api.telegram.org/bottest-bot/sendMessage", - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/lib/telegram-send.ts :100
`https://api.telegram.org/bot${bot}/${method}`, - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/lib/telegram-status.ts :135
const api = `https://api.telegram.org/bot${token}`; - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/lib/update-check.ts :336
`https://api.telegram.org/bot${token}/sendMessage`, - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/memory/brain.ts :125
const res = await fetch(`https://api.telegram.org/bot${BOT}/sendMessage`, { - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/poller/config.test.ts :137
assert.equal(config.api, "https://api.telegram.org/botundefined"); - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/poller/config.ts :28
export const API = `https://api.telegram.org/bot${TOKEN}`; - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/poller/transport.ts :85
`https://api.telegram.org/file/bot${TOKEN}/${String(path)}`, - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/setup/main.ts :462
const res = await fetch(`https://api.telegram.org/bot${token}/getMe`); - suspicious endpoint api.telegram.org smixs-iva-agent-f5bb315/scripts/update-finish.ts :471
`https://api.telegram.org/bot${token}/sendMessage`,
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:smixs/iva/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of smixs.