telegram-bot

SUSPICIOUS. The skill is mostly coherent with its stated purpose: it sets up a Telegram bot, stores the bot token locally, validates against Telegram's official API, and manages private access. The main concerns are install trust and scope expansion: the SKILL may clone and execute a mutable external GitHub repo when only SKILL.md is present, and it enables remote messaging access to the agent. No clear credential exfiltration to third-party domains or overtly malicious behavior is evident from the provided evidence, but the clone-and-run workflow and remote agent exposure make it higher risk than a simple documentation skill.