telegram-reader — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited telegram-reader (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reads Telegram channels and groups for financial news and market research using tdl, a Telegram CLI tool.
This skill is read-only. It is designed for financial research: reading channel messages, monitoring financial news channels, and exporting message history. It does NOT support sending messages, joining/leaving channels, or any write operations.
Current environment status:
!`(command -v tdl && tdl version 2>&1 | head -3 || echo "TDL_NOT_INSTALLED") 2>/dev/null`If the status above shows a version number, tdl is installed — skip to Step 2.
If TDL_NOT_INSTALLED, install tdl based on the user's platform:
| Platform | Install Command | |
|---|---|---|
| macOS / Linux | `curl -sSL https://docs.iyear.me/tdl/install.sh \ | sudo bash` |
| macOS (Homebrew) | brew install telegram-downloader | |
| Linux (Termux) | pkg install tdl | |
| Linux (AUR) | yay -S tdl | |
| Linux (Nix) | nix-env -iA nixos.tdl | |
| Go (any platform) | go install github.com/iyear/tdl@latest |
Ask the user which installation method they prefer. Default to Homebrew on macOS, curl script on Linux.
Current auth status:
!`(tdl chat ls --limit 1 2>&1 >/dev/null && echo "AUTH_OK" || echo "AUTH_NEEDED") 2>/dev/null`If AUTH_OK, skip to Step 3.
If AUTH_NEEDED, guide the user through login. Login requires interactive input — the user must enter their phone number and verification code manually.
Method A: QR Code (recommended — fastest)
tdl login -T qrA QR code will be displayed in the terminal. The user scans it with their Telegram mobile app (Settings > Devices > Link Desktop Device).
Method B: Phone + Code
tdl login -T codeThe user enters their phone number, then the verification code sent to their Telegram app.
Method C: Import from Telegram Desktop
If the user has Telegram Desktop installed and logged in:
tdl loginThis imports the session from the existing desktop client. The desktop client must be from the official website, NOT from the App Store or Microsoft Store.
By default, tdl uses a default namespace. To manage multiple accounts:
tdl login -n work -T qr # Login to "work" namespace
tdl chat ls -n work # Use "work" namespace for commandsMatch the user's request to one of the read operations below.
| User Request | Command | Key Flags |
|---|---|---|
| List all chats/channels | tdl chat ls | -o json, -f "FILTER" |
| List only channels | tdl chat ls -f "Type contains 'channel'" | -o json |
| Export recent messages | tdl chat export -c CHAT -T last -i N | --all, --with-content |
| Export messages by time range | tdl chat export -c CHAT -T time -i START,END | --all, --with-content |
| Export messages by ID range | tdl chat export -c CHAT -T id -i FROM,TO | --all, --with-content |
| Export from a topic/thread | tdl chat export -c CHAT --topic TOPIC_ID | --all, --with-content |
| Search for a channel by name | tdl chat ls -f "VisibleName contains 'NAME'" | -o json |
The -c flag accepts multiple formats:
| Format | Example |
|---|---|
| Username (with @) | -c @channel_name |
| Username (without @) | -c channel_name |
| Numeric chat ID | -c 123456789 |
| Public link | -c https://t.me/channel_name |
| Phone number | -c "+1 123456789" |
| Saved Messages | -c "" (empty) |
# List all chats
tdl chat ls
# JSON output for processing
tdl chat ls -o json
# Filter for channels only
tdl chat ls -f "Type contains 'channel'"
# Search by name
tdl chat ls -f "VisibleName contains 'Bloomberg'"Always use --all --with-content to get text messages (not just media):
# Last 20 messages from a channel
tdl chat export -c @channel_name -T last -i 20 --all --with-content -o /tmp/tdl-export.json
# Messages from a time range (Unix timestamps)
tdl chat export -c @channel_name -T time -i 1710288000,1710374400 --all --with-content -o /tmp/tdl-export.json
# Messages by ID range
tdl chat export -c @channel_name -T id -i 100,200 --all --with-content -o /tmp/tdl-export.jsontdl chat ls --limit 1 before other commands to verify the session is valid-T last -i 20 unless the user asks for more-T time filterAfter exporting, read the JSON file and extract the relevant information:
# Export messages
tdl chat export -c @channel_name -T last -i 20 --all --with-content -o /tmp/tdl-export.json
# Read and process the export
cat /tmp/tdl-export.jsonThe export JSON contains message objects with fields like id, date, message (text content), from_id, views, and media metadata.
After fetching data, present it clearly for financial research:
If something isn't working:
| Error | Cause | Fix |
|---|---|---|
not authorized or session errors | Not logged in or session expired | Run tdl login -T qr to re-authenticate |
FLOOD_WAIT_X | Rate limited by Telegram | Wait X seconds, then retry |
CHANNEL_PRIVATE | No access to channel | User must join the channel in their Telegram app first |
tdl: command not found | tdl not installed | Install using Step 1 |
references/commands.md — Complete tdl command reference for reading channels and exporting messagesRead the reference file when you need exact command syntax or detailed flag documentation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.