telegram — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited telegram (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
All operations via Telethon (user API, not bot API). One session file for everything.
api_id and api_hash.env: TG_API_ID=your_api_id
TG_API_HASH=your_api_hashpip install telethonpython3 scripts/tg_setup.pypython3 scripts/tg_setup.py --auth → enter phone + code from TelegramSession file is saved automatically. All subsequent operations reuse it.
Set TG_SESSION env var to point to your session file, or the skill auto-discovers it.
# Saved Messages
python3 scripts/tg_read.py --saved-messages --limit 10
# Specific chat/person
python3 scripts/tg_read.py --chat username --limit 20
# Public channel
python3 scripts/tg_read.py --channel SEOBAZA --limit 5
# With explicit session file
python3 scripts/tg_read.py --saved-messages --limit 5 --session /path/to/tg_session.sessionOutput: JSON lines (one per message) with: id, date, text, has_voice, has_audio, has_photo, has_document, mime_type, file_size, duration.
Fetch messages from public channels with text sanitization (anti-injection, emoji cleanup, link extraction, dedup hashing).
# Single channel
python3 scripts/tg_fetch_channels.py --channel SEOBAZA --limit 20
# Multiple channels
python3 scripts/tg_fetch_channels.py --channels SEOBAZA,seo_inside,serpstat --limit 10
# Since date
python3 scripts/tg_fetch_channels.py --channel SEOBAZA --since 2026-03-01
# Save to file
python3 scripts/tg_fetch_channels.py --channel SEOBAZA --output messages.jsonl
# Pretty JSON
python3 scripts/tg_fetch_channels.py --channel SEOBAZA --prettyOutput: JSONL with: channel, channel_id, id, date, text, text_sanitized, links, hash, views, forwards.
Sanitization: strips zero-width chars, excessive emoji, backtick injection, truncates at 2000 chars.
Fetch voice/audio/video_note messages and download the audio files.
# From Saved Messages
python3 scripts/tg_fetch_voice.py --saved-messages
# From specific chat
python3 scripts/tg_fetch_voice.py --chat username --limit 5
# Custom output directory
python3 scripts/tg_fetch_voice.py --saved-messages --audio-dir ./my-audioOutput: metadata JSONL (id, date, duration, media_type, file_path, file_size) + downloaded audio files.
Transcription: Use mlx-whisper or any Whisper model on the downloaded audio files. The skill handles Telegram I/O only — transcription is your choice of tool.
# Full diagnostic (env, session, deps, connectivity)
python3 scripts/tg_setup.py
# Create/refresh session (interactive auth)
python3 scripts/tg_setup.py --authskills/telegram/
├── SKILL.md ← This file
├── scripts/
│ ├── tg_read.py ← Read any chat (104 lines)
│ ├── tg_fetch_channels.py ← Parse channels → JSONL (165 lines)
│ ├── tg_fetch_voice.py ← Download voice/audio (219 lines)
│ ├── tg_setup.py ← Auth + diagnostics (198 lines)
│ └── sanitizer.py ← Text sanitization (84 lines)
└── references/
├── setup.md ← Detailed setup guide
└── json-schema.md ← Output format specDesign principle: Scripts produce JSON. No business logic, no classification, no transcription. Pure Telegram I/O. Pipe the output to whatever you need.
Scripts find the session file in this order:
--session CLI flagTG_SESSION env var.claude/data/telegram/tg_session.session (project-level)~/.telegram/tg_session.session (global fallback)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.