add-telegram — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-telegram (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Adds Telegram bot support via the Chat SDK bridge.
NanoClaw doesn't ship channels in trunk. This skill copies the Telegram adapter, its formatting/pairing helpers, their tests, and the pair-telegram setup step in from the channels branch.
Skip to Credentials if all of these are already in place:
src/channels/telegram.ts, telegram-pairing.ts, telegram-markdown-sanitize.ts (and their .test.ts siblings) all existsrc/channels/telegram-registration.test.ts existssrc/channels/index.ts contains import './telegram.js';setup/pair-telegram.ts exists and setup/index.ts's STEPS map contains 'pair-telegram':@chat-adapter/telegram is listed in package.json dependenciesOtherwise continue. Every step below is safe to re-run.
git fetch origin channelsgit show origin/channels:src/channels/telegram.ts > src/channels/telegram.ts
git show origin/channels:src/channels/telegram-registration.test.ts > src/channels/telegram-registration.test.ts
git show origin/channels:src/channels/telegram-pairing.ts > src/channels/telegram-pairing.ts
git show origin/channels:src/channels/telegram-pairing.test.ts > src/channels/telegram-pairing.test.ts
git show origin/channels:src/channels/telegram-markdown-sanitize.ts > src/channels/telegram-markdown-sanitize.ts
git show origin/channels:src/channels/telegram-markdown-sanitize.test.ts > src/channels/telegram-markdown-sanitize.test.ts
git show origin/channels:setup/pair-telegram.ts > setup/pair-telegram.tsAppend to src/channels/index.ts (skip if already present):
import './telegram.js';In setup/index.ts, add this entry to the STEPS map (right after the register line is fine; skip if already present):
'pair-telegram': () => import('./pair-telegram.js'),pnpm install @chat-adapter/[email protected]pnpm run build
pnpm exec vitest run src/channels/telegram-registration.test.tsBoth must be clean before proceeding. telegram-registration.test.ts is the one integration test: it imports the real channel barrel and asserts the registry contains telegram. It goes red if the import './telegram.js'; line is deleted or drifts, if the barrel fails to evaluate, or if @chat-adapter/telegram isn't installed (the import throws) — so it also implicitly verifies the dependency from step 5. The adapter also calls core's createChatSdkBridge(...); that typed core-API consumption is guarded by pnpm run build.
End-to-end message delivery against a real Telegram bot is verified manually once the service is running — see Next Steps and the pairing flow in Channel Info.
@BotFather/newbot and follow the prompts:123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11)Important for group chats: By default, Telegram bots only see @mentions and commands in groups. To let the bot see all messages:
@BotFather > /mybots > select your botAdd to .env:
TELEGRAM_BOT_TOKEN=your-bot-tokenSync to container: mkdir -p data/env && cp .env data/env/env
If you're in the middle of /setup, return to the setup flow now.
Otherwise, run /manage-channels to wire this channel to an agent group.
telegrampnpm exec tsx setup/index.ts --step pair-telegram -- --intent <main|wire-to:folder|new-agent:folder>, show the user the 4-digit CODE from the PAIR_TELEGRAM_ISSUED block (follow the REMINDER_TO_ASSISTANT line in that block), and tell them to send just the 4 digits as a message from the chat they want to register (DM the bot for main, post in the group otherwise). In groups with Group Privacy ON, prefix with the bot handle: @<botname> CODE. Wrong guesses invalidate the code — if a PAIR_TELEGRAM_ATTEMPT block arrives with a mismatched RECEIVED_CODE, a PAIR_TELEGRAM_NEW_CODE block will follow automatically (up to 5 regenerations); show the new code. On PAIR_TELEGRAM STATUS=failed ERROR=max-regenerations-exceeded, ask the user if they want to try again and re-invoke the step — each invocation starts a fresh 5-attempt batch. Success emits PAIR_TELEGRAM STATUS=success with PLATFORM_ID, IS_GROUP, and ADMIN_USER_ID. The service must be running for this to work (the polling adapter is what observes the code).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.