telegram-bot-basics
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill correctly identifies the security risk of Telegram Bot tokens and explicitly instructs developers to use environment variables (
process.env.BOT_TOKEN) instead of hardcoding or committing them to version control, which is a recognized security best practice. - [EXTERNAL_DOWNLOADS]: The documentation references the
agntdev/bot-startertemplate repository on GitHub. These references point to the author's own infrastructure and established public repositories, serving as legitimate sources for project scaffolding. - [INDIRECT_PROMPT_INJECTION]: The skill describes the ingestion and processing of untrusted user input from the Telegram API (e.g.,
ctx.message.text). While this represents a potential attack surface for indirect prompt injection if the data is later passed to an LLM, the skill is purely instructional and does not implement unsafe interpolation. The documentation highlights handling commands and callback data, which are standard bot operations. - [COMMAND_EXECUTION]: Code examples demonstrate the use of standard bot framework methods and an internal factory pattern (
makeBot). No arbitrary command execution or shell injection vulnerabilities were detected in the provided patterns.
Audit Metadata