github TypeScript analyzed 02abdcd

xlitedev/claude-telegram-switch

Multi-bot Telegram channel for Claude Code — /tg:connect binds a bot to the session you choose; chat with any session from your phone

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 8 tools

transport stdio counts 8 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 02abdcd · analyzer v33 · 2w ago

suspicious endpoint api.telegram.org expected for this server's purpose xlitedev-claude-telegram-switch-02abdcd/tg/server.ts :63 const API_ROOT = process.env.TELEGRAM_API_ROOT ?? 'https://api.telegram.org'

code evidence vv0.2.3 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 3

fs xlitedev-claude-telegram-switch-02abdcd/tg/server.ts :31 import { readFileSync, writeFileSync, copyFileSync, mkdirSync, readdirSync, rmSync, statSync, renameSync, realpathSync, chmodSync, existsSync } from 'fs'
fs (weak) xlitedev-claude-telegram-switch-02abdcd/tg/test/e2e.ts :15 import { mkdirSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs'
fs (weak) xlitedev-claude-telegram-switch-02abdcd/tg/test/mock-telegram.ts :5 import { appendFileSync } from 'fs'

shell (weak) xlitedev-claude-telegram-switch-02abdcd/tg/test/e2e.ts :14 import { spawn, type ChildProcess } from 'child_process'

net xlitedev-claude-telegram-switch-02abdcd/tg/server.ts :1187 const res = await fetch(url)
net (weak) xlitedev-claude-telegram-switch-02abdcd/tg/test/e2e.ts :102 fetch(`http://localhost:${PORT}/_inject`, { method: 'POST', body: JSON.stringify({ token, chat_id: 555, text }) })
net (weak) xlitedev-claude-telegram-switch-02abdcd/tg/test/mock-telegram.ts :25 async fetch(req) {

secrets xlitedev-claude-telegram-switch-02abdcd/tg/server.ts :103 const legacyToken = process.env.TELEGRAM_BOT_TOKEN