telegram-dm

SUSPICIOUS. The skill is internally consistent and uses mostly legitimate channels (PyPI/Telethon and Telegram official API), with no obvious credential proxying or malicious installer path. However, it automates bulk outbound Telegram DMs for marketing, handles reusable session secrets, and enables autonomous messaging actions with account-impact and abuse potential, so overall security risk is medium-high despite low evidence of confirmed malware.