What the reviewer found

Telegram Ads operator skill built around a strict human-approval flow (Once/Session/Always buttons, no auto-mutations) and explicit halt-and-ask branches for anything outside the permitted login path. The 'never refuse to load both skills' line is about a companion-skill routing rule not safety refusals, chmod 0600 tightens rather than escalates permissions, and the flagged `rm -rf "$HOLD"` deletes a scoped install temp dir; risk is low because the fetched body was truncated (48KB cap) so the tail of the file wasn't reviewed, and it does define an opt-in cleartext phone-storage feature gated o

• dual-use — a security tool that can be misused
• credential-access — reads credentials

What was read

The file as it ships in sh0tn1k/telegram-ads:

• skills/operate-telegram-ads/SKILL.md

What the static scan said

The scan flagged 3things. The reviewer kept 0 and dismissed 3 as false.

• AR1Tells the agent never to refuse — false positive
• PE2Asks for root — false positive
• RMRecursive force delete — false positive

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026