add-telegram
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
@chat-adapter/telegrampackage from the standard NPM registry using a pinned version (4.29.0). It also performs acurlrequest to the official Telegram API (https://api.telegram.org/bot{{bot_token}}/getMe) to validate the bot token and retrieve the bot's username. - [COMMAND_EXECUTION]: The skill executes several local development and service commands including
pnpm run build,pnpm exec vitest,pnpm exec tsx, and a restart script (bash setup/lib/restart.sh). These are standard operational commands for the project's environment. - [CREDENTIALS_UNSAFE]: The skill prompts the user for a Telegram Bot Token. It correctly instructs the user to store this in a
.envfile (TELEGRAM_BOT_TOKEN={{bot_token}}), which is a standard and recommended practice for secret management in development environments. The validation regex ensures the token follows the expected format. - [REMOTE_CODE_EXECUTION]: The skill uses a custom directive
nc:copy from-branch:channelsto copy source files (telegram.ts,telegram-pairing.ts, etc.) from another branch in the same repository. Since this is an internal repository operation, it is considered safe within the context of the skill's management of the local codebase.
Audit Metadata