telegram-bot-builder
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of bots that ingest untrusted user input from the Telegram Bot API.
- Ingestion points: Message handlers and conversation inputs (e.g.,
conversation.waitFor('message:text')andbot.on('message:photo', ...)inSKILL.md). - Capability inventory: The skill enables sending messages (
ctx.reply), editing content (ctx.editMessageText), and performing external side effects such as database writes through the Bot API. - Boundary markers: The instructions do not explicitly enforce markers to separate user content from instruction context, which is common in development templates.
- Sanitization: The documentation notes the need for escaping when using specific parse modes (HTML or MarkdownV2) to prevent formatting issues.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing well-known and standard Telegram library packages (grammY, Telegraf, python-telegram-bot) from official registries.
Audit Metadata