Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Pyrogram 2fa Setup Script For New Version

skill · ECNU-ICALK/AutoSkillLicence not declaredAudited 14 Oct 2026 · source 04e912cff54b

★ 602pushed 157 days agoversion 0.1.0
✕BLOCKGrade D · 69/100 · 1 finding · 04e912c
602repo stars · whole ECNU-ICALK/AutoSkill

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 04e912cff54b and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 1 finding, 1 critical or high. What it does: Generates a Python script using the latest Pyrogram library to set 2FA passwords for multiple Telegram accounts from a CSV file, specifically for accounts without existing passwords.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Pyrogram 2fa Setup Script For New Version (ECNU-ICALK/AutoSkill)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/ecnu-icalk/pyrogram-2fa-setup-script-for-new-version

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SKILL.md:39. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score69/100✕BLOCK D
1 critical0 high0 medium0 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: critical finding, no behavioural pass, undeclared transfer.

Findings (1)

CRITICALPrompt injectionprompt.transfer_instruction · SKILL.md:39
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Fetch server password configuration using `await app.send(functions.account.GetPassword())`.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine

Audit 0.4.1 · source sha 04e912cff54b · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

What it tells the agent

Full source on GitHub ↗

Its description: Generates a Python script using the latest Pyrogram library to set 2FA passwords for multiple Telegram accounts from a CSV file, specifically for accounts without existing passwords.

---
id: "ab62767b-9a13-4a59-bdb0-bf3659a75f33"
name: "Pyrogram 2FA Setup Script for New Version"
description: "Generates a Python script using the latest Pyrogram library to set 2FA passwords for multiple Telegram accounts from a CSV file, specifically for accounts without existing passwords."
version: "0.1.0"
tags:
  - "python"
  - "pyrogram"
  - "telegram"
  - "2fa"
  - "automation"
triggers:
  - "pyrogram 2fa script"
  - "set 2fa password pyrogram"
  - "enable cloud password pyrogram"
  - "pyrogram script for multiple accounts"
  - "rewrite pyrogram script for new version"
---

# Pyrogram 2FA Setup Script for New Version

Generates a Python script using the latest Pyrogram library to set 2FA passwords for multiple Telegram accounts from a CSV file, specifically for accounts without existing passwords.

## Prompt

# Role & Objective
You are a Python developer specializing in the Pyrogram library. Your task is to write scripts that enable Two-Step Verification (2FA/Cloud Password) for Telegram accounts listed in a CSV file.

# Operational Rules & Constraints
1. **Input Source**: The script must read a list of phone numbers from a file named `phone.csv`.
2. **Account State**: The script is intended for accounts that do **not** have an existing password. Do not include logic to verify or input a current password.
3. **Library Version**: Use the latest Pyrogram API syntax to avoid `AttributeError` or `ImportError`.
   - Import `Client` from `pyrogram`.
   - Import `functions` from `pyrogram.raw`.
   - Import `hash_pbkdf2_sha512` from `pyrogram.crypto`.
   - Import `utils` from `telethon.sync` for phone parsing.
4. **Client Initialization**: Initialize the `Client` using `api_id` and `api_hash` as **keyword arguments** (e.g., `api_id=..., api_hash=...`).
5. **Password Logic**:
   - Fetch server password configuration using `await app.send(functions.account.GetPassword())`.
   - Use the `new_algo` object from the response to determine salt and iterations.
   - Generate the password hash using `hash_pbkdf2_sha512(password, r.new_algo.salt1 + r.new_algo.salt2, r.new_algo.iterations)`.
   - Send the update request using `functions.account.UpdatePasswordSettings` with `password=None` (indicating no current password) and `new_settings` containing the new algorithm and hash.
6. **Looping**: Iterate through the phone numbers and apply the 2FA setting to each account.

# Anti-Patterns
- Do not use deprecated methods like `app.rnd_key()`, `app.password_hash()`, or imports like `from pyrogram.raw import Types`.
- Do not prompt for a current password.
- Do not use positional arguments for `api_id` and `api_hash` in the `Client` constructor.

## Triggers

- pyrogram 2fa script
- set 2fa password pyrogram
- enable cloud password pyrogram
- pyrogram script for multiple accounts
- rewrite pyrogram script for new version

Excerpt, first 2,852 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 04e912c

git clone https://github.com/ECNU-ICALK/AutoSkill
git -C AutoSkill checkout 04e912cff54b

The author documents no install command, so this uses the repository directly. Our verdict covers commit 04e912cff54b only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 04e912cff54b

Similar skills

Questions about Pyrogram 2fa Setup Script For New Version

What does the Pyrogram 2fa Setup Script For New Version skill do?
AutoSkill: Experience-Driven Lifelong Learning via Skill Self-Evolution
Is Pyrogram 2fa Setup Script For New Version safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can Pyrogram 2fa Setup Script For New Version access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (04e912cff54b), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.