telegram-bots
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and provided Python fixture focus exclusively on security best practices for the Telegram Bot API. It provides correct implementations for webhook secret validation using constant-time comparisons and highlights the importance of using update_id as a unique constraint to prevent double-processing of events.
- [PROMPT_INJECTION]: While the skill describes handlers for processing untrusted Telegram updates, it focuses on the transport and delivery layer rather than instructions that would allow for injection into the agent's core behavior. It provides mitigations by advocating for strict schema validation and state-based logic.
- [DATA_EXFILTRATION]: No patterns of data exfiltration were found. The skill actively advises against logging sensitive information such as file paths containing bot tokens.
- [COMMAND_EXECUTION]: No unauthorized command execution patterns were detected. The provided script, fixtures/update_delivery.py, is a self-contained test harness that uses only the Python standard library to simulate and verify logic invariants.
Audit Metadata