skills/nanocoai/nanoclaw/add-telegram/Gen Agent Trust Hub

add-telegram

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the @chat-adapter/telegram package from the standard NPM registry using a pinned version (4.29.0). It also performs a curl request to the official Telegram API (https://api.telegram.org/bot{{bot_token}}/getMe) to validate the bot token and retrieve the bot's username.
  • [COMMAND_EXECUTION]: The skill executes several local development and service commands including pnpm run build, pnpm exec vitest, pnpm exec tsx, and a restart script (bash setup/lib/restart.sh). These are standard operational commands for the project's environment.
  • [CREDENTIALS_UNSAFE]: The skill prompts the user for a Telegram Bot Token. It correctly instructs the user to store this in a .env file (TELEGRAM_BOT_TOKEN={{bot_token}}), which is a standard and recommended practice for secret management in development environments. The validation regex ensures the token follows the expected format.
  • [REMOTE_CODE_EXECUTION]: The skill uses a custom directive nc:copy from-branch:channels to copy source files (telegram.ts, telegram-pairing.ts, etc.) from another branch in the same repository. Since this is an internal repository operation, it is considered safe within the context of the skill's management of the local codebase.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:00 AM
Security Audit — agent-trust-hub — add-telegram