Skills
Navigate
skills/victorzhuk/skills/z-go-telegram-bot/Gen Agent Trust Hub

z-go-telegram-bot

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill follows security best practices for handling sensitive Telegram Bot API data. Specifically:
  • [CREDENTIALS_UNSAFE]: It correctly warns against logging HTTP errors that might contain the bot token in the URL path and provides a safeTransportError wrapper to sanitize these errors.
  • [DATA_EXFILTRATION]: It uses subtle.ConstantTimeCompare for validating webhook secret tokens, preventing timing attacks.
  • [INDIRECT_PROMPT_INJECTION]: It provides a robust EscapeMarkdownV2 utility to ensure dynamic user input is properly escaped before being sent to Telegram, preventing formatting-based injection or message spoofing.
  • [DATA_EXFILTRATION]: It implements secure HMAC-SHA256 signature validation for Telegram Mini App initData, including mandatory expiry checks on auth_date to prevent replay attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:19 PM