Is telegram-channel-poster safe to install?

SaferSkills independently audited telegram-channel-poster (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/telegram-channel-poster/SKILL.md · 1 file

skills/telegram-channel-poster/SKILL.md2.2 KB · Markdown

name: telegram-channel-poster

description: Use when the user asks to publish, post, announce, syndicate, or automatically send content to a Telegram channel using a native Telegram bot rather than Beeper chat lookup.

Telegram Channel Poster

Use this skill for outbound Telegram channel publishing through the native Telegram Bot API.

Safety

Posting is external communication. If the user did not explicitly ask to publish in this turn, prepare a dry run and ask before sending.
Never write bot tokens, channel secrets, or invite links into the skill. Load them from a private env file, Keychain, or OpenClaw secrets.
The bot must be an administrator in the target channel. Use @channelusername or the Bot API channel id.
Keep Beeper separate: telegram-chats is for reading chats; this skill is for native bot/channel publishing.

Helper

./scripts/telegram_channel_post.sh --dry-run --text "Hello"
./scripts/telegram_channel_post.sh --text "Hello"
./scripts/telegram_channel_post.sh --file /path/to/message.md --parse-mode MarkdownV2

Required env file shape:

TELEGRAM_BOT_TOKEN="123456:token-from-botfather"
TELEGRAM_CHANNEL_ID="@channelusername"

Optional Notion logging uses the notion-openclaw-log skill:

TELEGRAM_NOTION_LOG="true"
NOTION_PARENT_PAGE_ID="page-id-shared-with-integration"

Workflow

Confirm the user requested an external Telegram post.
Draft the exact message locally.
Run the helper with --dry-run and inspect the redacted payload.
For first-time setup, ask the user for the BotFather token and channel id, then store them outside the skill.
If the user wants an audit trail, enable TELEGRAM_NOTION_LOG=true and dry-run the Notion payload.
Send with the helper only after the publish intent is explicit.
Verify the Telegram API response has "ok": true; if not, report the API error without exposing the token.

References

Telegram Bot API sendMessage: https://core.telegram.org/bots/api#sendmessage
Telegram Bot API dialog ids: https://core.telegram.org/api/bots/ids
Optional local Notion log skill, configured via NOTION_HELPER.

Tests

python3 scripts/test_telegram_channel_post.py

telegram-channel-poster— agent skill

Is telegram-channel-poster safe to install?

Telegram Channel Poster

Safety

Helper

Workflow

References

Tests

Audit the pieces. Scan the whole. Decide.