building-telegram-bots — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited building-telegram-bots (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Prevents stale-knowledge failures when writing Telegram bot code. The Bot API updates roughly quarterly and frameworks more often, so training-time knowledge is unreliable — this skill enforces a verification protocol (detect, fetch, confirm) before any bot code is generated.
Covered: python-telegram-bot, aiogram (Python); grammY, Telegraf (Node.js)
Not covered: Other languages or frameworks; Telegram client API (TDLib); bot deployment and hosting; payment and monetisation APIs
Run this protocol before writing any bot code. Do not skip steps.
Read the project dependency manifest:
pyproject.toml first, then requirements.txtpackage.json → dependencies and devDependenciesIdentify which framework is present and its pinned or constrained version. If a lock file exists (package-lock.json, poetry.lock, uv.lock), read it for the exact resolved version.
See references/framework-guide.md → "Detecting Framework Version from Project Files" for manifest patterns.
Map the framework version to its supported Bot API version.
See references/framework-guide.md → "Framework Fact Sheets" for the current mapping table.
Staleness warning: If the project uses Telegraf v4.x, issue an explicit warning before proceeding. See references/framework-guide.md → "Telegraf Staleness Warning" for required warning text.
Fetch https://core.telegram.org/bots/api#recent-changes to identify the current Bot API version. Compare it to the version the project's framework targets. Note any gap.
If the user is asking about a feature introduced in a Bot API version newer than the framework's support ceiling, tell them the framework does not yet support it.
Do not rely on training knowledge for method signatures, handler registration patterns, or type names. Fetch the framework's current documentation for the specific feature.
See references/framework-guide.md → "Framework Fact Sheets" (each sheet's "Documentation URLs" block) for the correct URL per framework.
For versioned docs (python-telegram-bot, aiogram), use the URL pattern for the exact version found in Step 1 — not the "latest" or "stable" alias, unless the installed version matches it.
All current framework major versions use async/await. Synchronous bot code indicates a v13-era python-telegram-bot pattern (or aiogram v2). If the installed version is v20+ (python-telegram-bot) or v3+ (aiogram), all handler callbacks must be async def and all API calls must be awaited.
Write code only after completing Steps 1–5. Reference the fetched documentation, not training memory, for method signatures and parameter names.
Read `references/framework-guide.md` → "Migration Traps" before working on projects that show signs of a version upgrade. Signs include mixed sync/async patterns, old import paths, or a dependency version bump in git history.
For rate limit and webhook storm patterns, see references/telegram-bot-api.md → "Operational Limits" and "Webhook Storm Prevention".
When starting a new bot (no existing project manifest):
Confirm the recommendation by checking references/framework-guide.md → "Framework Fact Sheets" for current maintenance status before advising.
Read these files when the verification protocol directs you to them. Do not load both upfront — load on demand.
references/telegram-bot-api.md — Bot API structure, section anchors, operational limits, webhook vs pollingreferences/framework-guide.md — Framework fact sheets, detection algorithms, documentation URLs, migration trapsThese reference files contain version-specific data last verified on the date shown at the top of each file. If significant time has passed since that date, treat the framework versions and Bot API mappings as approximate and verify against the URLs provided in each file.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.