using-telegram-bot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-telegram-bot (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Short guide to build Telegram bots with telegraf (Node.js).
npm install telegrafBOT_TOKEN.// bot.js
const { Telegraf, Markup } = require('telegraf');
const bot = new Telegraf(process.env.BOT_TOKEN);
bot.start(ctx => ctx.reply('Welcome! I can help with commands.'));
bot.command('echo', ctx => {
const text = ctx.message.text.split(' ').slice(1).join(' ');
ctx.reply(text || 'usage: /echo your message');
});
bot.on('text', ctx => ctx.reply(`You said: ${ctx.message.text}`));
bot.launch();
process.once('SIGINT', () => bot.stop('SIGINT'));
process.once('SIGTERM', () => bot.stop('SIGTERM'));Run:
BOT_TOKEN=123:ABC node bot.js// send photo
await ctx.replyWithPhoto('https://example.com/image.jpg', { caption: 'Nice pic' });
// send document
await ctx.replyWithDocument('https://example.com/file.pdf');// show inline buttons
await ctx.reply('Choose:', Markup.inlineKeyboard([
Markup.button.callback('OK', 'ok'),
Markup.button.callback('Cancel', 'cancel')
]));
bot.action('ok', ctx => ctx.reply('You pressed OK'));
bot.action('cancel', ctx => ctx.reply('Cancelled'));const express = require('express');
const { Telegraf } = require('telegraf');
const bot = new Telegraf(process.env.BOT_TOKEN);
const app = express();
app.use(bot.webhookCallback('/telegraf'));
bot.telegram.setWebhook(`${process.env.PUBLIC_URL}/telegraf`);
app.listen(process.env.PORT || 3000);Use webhooks for production deployments (faster, lower resource use).
bot.catch((err, ctx) => {
console.error('Bot error', err);
});NODE_ENV=production and graceful shutdown hooks for reliability.This doc shows the most common Telegraf patterns: start/command handlers, text handlers, media, inline buttons, webhook setup, and error handling.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.