The Agent Skills Directory

[DATA_EXPOSURE]: The skill uses placeholder tokens in examples and environment templates. Scripts like test_bot.py and send_message.py include logic to mask these tokens in console output and error messages to prevent accidental leakage.
[COMMAND_EXECUTION]: The setup_project.py script performs local file operations to initialize projects by copying boilerplate files from the skill's assets. It does not execute arbitrary shell commands or download remote scripts.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for building AI-integrated bots that ingest untrusted user input from Telegram.
Ingestion points: Telegram bot handlers in bot.py, handlers.ts, and webhook_server.py.
Boundary markers: Absent in the AI integration example in SKILL.md.
Capability inventory: The skill provides full Telegram API access (send message, delete message, restrict users, etc.).
Sanitization: escapeHtml is used in Node.js boilerplate for output; absent for LLM prompt construction.
[EXTERNAL_DOWNLOADS]: The skill references official Telegram API endpoints and uses well-known, trusted libraries from official registries.

telegram