telegram
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard Telegram bot functionality with no evidence of malicious intent or hidden capabilities.
- [COMMAND_EXECUTION]: The entry point
cli.jsutilizesspawnSyncto execute the connector's logic. This is a controlled implementation used to handle environment-specific Node.js requirements and does not expose a vector for arbitrary command injection. - [DATA_EXFILTRATION]: Network activity is restricted to the official Telegram Bot API endpoint (
api.telegram.org). This communication is essential for the skill's purpose and uses well-known, trusted domains. - [CREDENTIALS_UNSAFE]: The skill avoids hardcoding secrets. It correctly implements support for Zapier-managed connection proxies and environment variable injection for the Telegram bot token, including documentation that warns users against logging sensitive credentials.
- [EXTERNAL_DOWNLOADS]: All Node.js dependencies are standard, versioned packages from the Zapier SDK or reputable public registries, with no risky remote script execution patterns observed.
Audit Metadata