telegram
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes environment variables for all sensitive credentials (TELEGRAM_API_HASH, TELEGRAM_SESSION_STRING) and includes explicit instructions to the AI agent to never echo or log these secrets.
- [SAFE]: A robust safety mechanism is implemented where all write or destructive actions (send, delete, edit, react) require a --confirm flag as the final argument. The script defaults to a dry-run mode, ensuring users can review the planned action before it is executed.
- [SAFE]: The materialize_file function in the auxiliary script handles remote URL downloads securely by validating the protocol (restricting to HTTP/HTTPS) and using temporary file management with proper cleanup.
- [SAFE]: The skill correctly manages indirect prompt injection risks common in messaging tools by requiring explicit user confirmation for any actions driven by the content of processed messages.
Audit Metadata