The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell commands for interacting with the official Telegram API. Evidence: curl -s "https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates" | python3 -m json.tool. This pattern was flagged by automated scans but is benign in context, as it utilizes the standard Python JSON formatting module to prettify API responses for the developer.
[EXTERNAL_DOWNLOADS]: The skill interacts with api.telegram.org, which is a well-known and trusted service for bot operations. No untrusted third-party domains or suspicious external scripts are involved.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to store sensitive bot tokens and chat IDs in .env files rather than hardcoding them, following standard security best practices for secret management.
[REMOTE_CODE_EXECUTION]: There is no evidence of remote code execution. The reference files use standard libraries (httpx, requests, and native Node fetch) to perform authorized POST requests to the Telegram API.

tg-alerts