Is telegram-approval-gate safe to install?

SaferSkills independently audited telegram-approval-gate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/telegram-approval-gate/SKILL.md · 1 file

skills/telegram-approval-gate/SKILL.md2.4 KB · Markdown

name: telegram-approval-gate

description: Use when Hermes is about to send, publish, forward, reply, post, email, DM, or otherwise deliver text/media to another person, group, channel, or external service and the operator expects Telegram confirmation buttons.

Telegram Approval Gate

Before Hermes sends external communication, route the final draft through the operator's Telegram approval gate.

Rule

Never send user-facing or public content directly when this skill applies. First send a Telegram approval card with:

Senden - send the draft exactly as approved.
Bearbeiten - ask the operator for edits, revise the draft, then submit a new approval card.
Abbrechen - stop without sending.

This applies to Telegram, WhatsApp, Signal, email, social posts, channels, group messages, support replies, public comments, and any automation that sends on the operator's behalf.

Helper

Use the bundled helper when a real Telegram approval round is needed:

python3 ~/.hermes/skills/messaging/telegram-approval-gate/scripts/telegram_approval_gate.py \
  --title "Freigabe" \
  --draft-file /path/to/draft.txt

Required environment:

HERMES_APPROVAL_BOT_TOKEN - a dedicated approval bot token.
HERMES_APPROVAL_CHAT_ID - the operator's approval DM/chat id.

Do not reuse the live Hermes/OpenClaw Telegram bot token while another gateway is polling it. A dedicated approval bot avoids getUpdates conflicts.

For dry runs:

python3 ~/.hermes/skills/messaging/telegram-approval-gate/scripts/telegram_approval_gate.py \
  --dry-run \
  --draft "Hallo"

Workflow

Draft the exact outgoing message locally.
Run the approval helper or use the active messaging gateway's native inline-button approval mechanism.
If the decision is send, deliver exactly the approved content.
If the decision is edit, ask the operator for changes, revise, and repeat approval.
If the decision is cancel or timeout, do not send.
Record the approval result in the task summary.

Testing

Run the local end-to-end fake Telegram test before relying on changes:

python3 ~/.hermes/skills/messaging/telegram-approval-gate/tests/test_telegram_approval_gate.py

Optional live smoke test requires HERMES_APPROVAL_BOT_TOKEN and HERMES_APPROVAL_CHAT_ID; do not run it with the same token currently owned by OpenClaw/Hermes gateway polling.

telegram-approval-gate— agent skill

Is telegram-approval-gate safe to install?

Telegram Approval Gate

Rule

Helper

Workflow

Testing

Audit the pieces. Scan the whole. Decide.