telegram
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill ensures secure secret management by accessing the Telegram Bot Token via a platform-provided environment variable (BUB_TELEGRAM_TOKEN), preventing the exposure of credentials in logs or shell history.
- [SAFE]: Command execution is handled securely; the instructions explicitly direct the agent to pass message content through stdin using heredocs, which prevents shell injection and syntax errors associated with special characters in command-line arguments.
- [SAFE]: The skill relies on standard, well-known Python dependencies (requests and telegramify-markdown) managed via uv, ensuring a consistent and isolated execution environment without suspicious third-party packages.
- [SAFE]: All network operations are performed against official Telegram API infrastructure (api.telegram.org), and the scripts do not contain any logic for data exfiltration to non-whitelisted domains.
Audit Metadata