Agent Babysitter mascot Agent Babysitter GitHub
home / security

Security

Agent Babysitter connects a Telegram bot to a machine where Claude Code can run commands. That's powerful, so it's worth being precise about who can reach it — and the few things it deliberately does not protect against.

Only you can message your bot

  • Pairing writes your Telegram user ID to an allowlist. Every inbound message is checked against it; anyone not on the list is dropped before Claude ever sees it — no reply, no pairing offer, nothing.
  • Numeric IDs can't be spoofed. Telegram user IDs are permanent, so changing a display name or username can't sneak anyone onto your allowlist.
  • Pairing is inverted on purpose. Your terminal generates the PIN and waits for it — unknown senders are never answered. The PIN comes from /dev/urandom, drops look-alike characters, expires in 5 minutes, and only counts from a private chat.

How your secrets are protected

  • The bot token never appears in ps. Every API call pipes the URL through curl -K - so the token stays out of the process's argument list. (Verified: a canary token wasn't visible in ps during a live call.)
  • Files are owner-only. The script runs umask 077; the token and allowlist are 600, their directories 700. Writes go through a temp file and mv, so a crash can't leave a half-written token.
  • Claude is told the rules. The injected prompt forbids sending secrets over Telegram, treats fetched content as data not commands, and requires terminal confirmation for anything destructive.

Enforced controls (defense in depth)

  • A remote kill ladder that doesn't trust the model. Send any of these from Telegram as a whole message and the session hook acts on it itself — so they work even if the model is prompt-injected: ABS MUTE/ABS UNMUTE (mute / resume reports), ABS OFF (cut inbound + outbound; session keeps working), ABS STOP (halt at the next step), ABS EXIT (close the session, confirms if mid-task), ABS BLOCK (lock the bot out until a terminal abs setup).
  • A destructive-command guard. When a turn is driven from Telegram, a PreToolUse hook blocks a small, high-confidence set of dangerous commands — rm -rf, git push --force, reset --hard, DROP/TRUNCATE, DELETE without WHERE, reads of .env/keys — and tells you to run them at the terminal. From the terminal, nothing is blocked. Opt out: abs config guard off.
  • Honest limit — this is defense-in-depth, not a sandbox. A determined, compromised model could obfuscate a command to slip past the pattern match, so the guard raises the floor, it isn't a wall. Claude Code's own permission system remains the real boundary.

What this does not protect against

  • Telegram sees your messages. Bot chats aren't end-to-end encrypted. Voice is transcribed and synthesized locally, but the audio still travels over Telegram. Don't use this for work where that matters.
  • Your bot token is a credential. It lives in plaintext protected by file permissions, not encryption. If it leaks, revoke it in @BotFather and run abs setup again.
  • Anyone with your unlocked phone can instruct Claude. The allowlist authenticates a Telegram account, not a person. Lock your phone.
  • It is not a sandbox. Within your paired account, Claude has whatever power Claude Code gives it. The allowlist decides who can reach the session, not what it can do — that boundary is Claude Code's own permission system.
  • reset, not setup, clears the allowlist. Re-running abs setup adds to it. To revoke access for everyone, run abs reset.
  • The conversation log is a second copy of everything. With the log on (the default), your messages, abs's replies, and the tools it ran are written to ~/.abs/<profile>/log/ — local, 600, never uploaded. Control chars are stripped and secrets are scrubbed best-effort (Telegram/OpenAI/GitHub/AWS/Google/Slack keys, JWTs, PEM keys, key=/password= pairs, URL passwords) — but an unrecognised secret shape can still land there, and home-dir backups pick it up. Turn it off with abs config log off, delete it with abs log --clear.
  • The install chain is trust-by-HTTPS. install.sh fetches abs.sh (and can run Bun's and Claude Code's own curl | bash installers) over HTTPS with no checksum — standard for this class of tool. A cloned-checkout install skips the download. The on-launch update check compares versions with GitHub and, on an interactive terminal, offers to update — but only after you answer y to a prompt (default is no); it never updates without asking (opt out: abs config update-check off).

Reporting a vulnerability

Found something? Open an issue at github.com/Pranjalab/AgentBabysitter/issues, or for anything sensitive, describe it privately rather than in a public issue. The full threat model lives in SECURITY.md.
← Back to home  ·  v2.1.4  ·  MIT License  ·  Made with ♥ for Claude Code users