tdmcp-telegram-ollama-copilot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tdmcp-telegram-ollama-copilot (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Coordinate the dedicated team that turns Telegram messages into safe local Ollama-powered tdmcp copilot turns against TouchDesigner. This specializes the generic tdmcp pipeline for a chat-facing control surface with stricter security and confirmation requirements.
This repo currently runs teams as coordinated sub-agents rather than TeamCreate. Use a hybrid sub-agent workflow:
| Phase | Mode | Reason |
|---|---|---|
| Plan | local lead or telegram-copilot-lead | keep the scope tied to the local-first architecture and security gates. |
| Bot + LLM build | parallel sub-agents | Telegram intake and LLM/tool-call reuse have mostly disjoint write scopes. |
| Bridge/layout hardening | sequential sub-agent | bridge/client/node-layout slices share files and must not run in parallel. |
| Integrate/docs | single-writer sub-agent | CLI, config docs, and generated docs surfaces are shared files. |
| QA/fix loop | sub-agent fan-in | QA routes precise security or boundary defects to the owner. |
All spawned agents use model: "opus" unless the user explicitly requests a different model.
| Agent | Role | Skills | Output |
|---|---|---|---|
telegram-copilot-lead | scope owner and wave captain | this skill | _workspace/telegram-copilot/00_plan.md |
telegram-bot-engineer | Telegram Bot API client, long polling, command parser, allowlists | telegram-copilot-build | _workspace/telegram-copilot/01_telegram_bot.md |
ollama-copilot-engineer | runAgentTurn/LlmClient reuse, tiers, confirmation state | telegram-copilot-build | _workspace/telegram-copilot/02_ollama_agent.md |
tdmcp-bridge-engineer | bridge/client/node-layout hardening if needed | tdmcp-bridge-endpoint | _workspace/telegram-copilot/02_bridge_layout.md |
td-integrator | single-writer CLI/config/docs/registry integration | td-feature-integrate | _workspace/telegram-copilot/03_integrate.md |
telegram-copilot-qa | Telegram/Ollama/security/live-control QA | telegram-copilot-qa | _workspace/telegram-copilot/04_qa.md |
Read these before changing code:
CLAUDE.md.claude/agents/telegram-copilot-lead.md.claude/skills/telegram-copilot-build/SKILL.md.claude/skills/telegram-copilot-qa/SKILL.mdsrc/llm/agent.tssrc/llm/client.tssrc/llm/tools.tssrc/cli/ask.tssrc/cli/chat.tssrc/utils/config.tsdocs/reference/cli.mddocs/reference/environment.mdgit status --short._workspace/telegram-copilot/.affected phase;
with a timestamp before starting a new one.
live-control claim.
Create _workspace/telegram-copilot/00_plan.md with:
integration/docs, QA, or all;
Default execution order:
disjoint;
available.
Run in parallel when both are in scope:
telegram-bot-engineer: Bot API client, long polling, command parser,allowlist, message sending, CLI/config hooks assigned by the plan.
ollama-copilot-engineer: local copilot reuse, conversation state, tool tiers,confirmation gates, Telegram event translation assigned by the plan.
Each agent writes its _workspace/telegram-copilot/0*_*.md note.
Invoke tdmcp-bridge-engineer sequentially only if the plan needs bridge/client changes, such as making create_td_node apply deterministic nodeX/nodeY or promoting a proven /api/exec path to a first-class endpoint.
Do not run another bridge/client editor in parallel with this phase.
Invoke td-integrator for shared files after builders report exports and desired CLI/config/docs entries. The integrator owns shared surfaces such as:
src/index.ts / CLI command dispatch;src/cli/* shared command tables;src/utils/config.ts;docs/reference/cli.md;docs/reference/environment.md;The integrator must run npm run typecheck and npm run build. If docs changed, also run the docs gate that matches the touched files.
Invoke telegram-copilot-qa incrementally:
QA sends precise defects to the owner and re-validates after fixes. Cap repeated fix loops at 2-3 rounds, then report the blocker.
Report:
Do not tag, release, or push unless the user explicitly asks.
user request
-> lead plan
-> Telegram bot engineer -------+
-> Ollama copilot engineer -----+-> integrator -> QA -> fixes -> final report
-> bridge engineer when needed -+| Situation | Strategy |
|---|---|
| Telegram token missing | Build and test with mocks; mark live Telegram check UNVERIFIED. |
| Ollama unavailable | Test fake LLM boundary; mark live model check UNVERIFIED. |
| TouchDesigner bridge offline | Run offline gates; mark live TD control UNVERIFIED. |
| Non-allowlisted chat reaches LLM | QA FAIL; block shipment until fixed. |
| Mutating tool executes without confirmation | QA FAIL; block shipment until fixed. |
| Bridge/client shared-file conflict | Stop parallel edits and have the lead reassign single ownership. |
| QA fail after 3 rounds | Hold failing slice; report evidence and next fix. |
User says "executa o time Telegram + Ollama para controlar TouchDesigner." The orchestrator creates _workspace/telegram-copilot/00_plan.md, runs Telegram and LLM slices in parallel, hardens bridge/layout if remote creation is in scope, integrates CLI/config/docs, runs mocked Bot API and LLM tests, runs repo gates, and live-validates only when Telegram credentials, Ollama, and TouchDesigner are available.
Telegram credentials are not present and TouchDesigner is offline. The team still builds the mocked Bot API path, fake LLM tool-call path, and config/docs surfaces; QA marks live Telegram and bridge checks UNVERIFIED, and the final report names the exact env vars/services required for the live pass.
Should trigger:
Should not trigger:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.