The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The SKILL.md instructions (and its copies in the plugins and skills directories) guide the agent to download the bridge's implementation code from the author's GitHub repository using git clone https://github.com/hec-ovi/telegram-bot-skill if the source is not already present.
[COMMAND_EXECUTION]: The skill makes extensive use of child_process.spawn to manage the bridge daemon and execute the underlying AI agents (e.g., claude, pi). It also executes various setup and management tasks via npm scripts and shell commands described in the instruction files.
[CREDENTIALS_UNSAFE]: The skill handles the sensitive TELEGRAM_BOT_TOKEN, retrieving it from environment variables or a local .env file. It mitigates risk by instructing agents to store the token in a file with restricted permissions (mode 600), as seen in src/setup.ts and SKILL.md instructions.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a vulnerability surface by ingesting untrusted data from an external source (Telegram) and passing it as a prompt to a powerful, shell-capable agent.
Ingestion points: External updates, including user messages and button callback data, are received from the Telegram Bot API and normalized in src/telegram/poller.ts.
Boundary markers: A deterministic gate (src/gate/gate.ts) provides a security boundary by enforcing user authorization based on Telegram IDs (Owner, Trusted, Guest), but it does not sanitize or add markers to the message content to prevent the underlying agent from following embedded instructions.
Capability inventory: The agent adapters (src/agents/claude-code/adapter.ts, src/agents/pi/adapter.ts) spawn CLI agent processes that typically have significant local system access (file system, shell, networking).
Sanitization: No validation, escaping, or instruction-filtering is applied to the message text before it is interpolated into the agent's prompt.

telegram-bot