Telegram CLI
v0.1.0Telegram CLI for reading, searching, and sending messages. Use when the user asks about Telegram messages, wants to check inbox, search chats, send messages, or look up contacts and groups.
⭐ 1· 3.7k·20 current·20 all-time
by@arein
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, commands in SKILL.md, and README all consistently describe a Telegram CLI (read, search, send messages, list contacts/groups). Requesting Telegram API credentials (my.telegram.org) is expected for this purpose.
Instruction Scope
Runtime instructions are limited to installing the CLI, running 'tg auth' to authenticate, and using explicit read/write/search commands. The SKILL.md does not instruct the agent to read unrelated files, environment variables, or to exfiltrate data to third-party endpoints beyond Telegram's API.
Install Mechanism
The skill is instruction-only but tells the user/agent to run 'npm install -g @cyberdrk/tg' (or build from source). Installing an npm package is a normal install path for such a CLI, but it carries moderate risk because postinstall scripts or the package code could execute arbitrary actions. The package owner/source is not declared in the registry metadata (source/homepage unknown), so the package's provenance and publish-time integrity are unclear.
Credentials
The README and SKILL.md correctly require Telegram API credentials (api_id/api_hash) — proportional and expected. However, registry metadata declared no config paths while the README says configuration and encrypted session data are stored in ~/.config/tg/ (config.json + session). This is a minor mismatch: the tool will read/write local session files even though those paths weren't declared in metadata.
Persistence & Privilege
always is false (normal). The README suggests optionally symlinking SKILL.md into ~/.claude/skills to register the skill with a local Claude agent — this modifies the user's agent skills directory but is an explicit user action. No evidence the skill requests permanent elevated privileges or alters other skills automatically.
What to consider before installing
Before installing or running this skill: 1) Verify the npm package @cyberdrk/tg on the npm registry and its upstream repository (review source code, maintainers, recent publish times, and issues). 2) Prefer installing from a inspected source (clone the GitHub repo, review package.json and any postinstall scripts) rather than blindly running 'npm install -g'. 3) Be aware the tool will store session/config in ~/.config/tg/ — confirm the encryption/storage claims and back up/remove sensitive files if needed. 4) Only provide Telegram api_id/api_hash from https://my.telegram.org/apps and avoid sharing your phone/SMS codes. 5) If you want stronger assurance, ask the publisher for a homepage/repo link or request a signed release; otherwise treat this as unverified third-party software and proceed with caution.Like a lobster shell, security has layers — review code before you run it.
chatvk9742367vfqv6vyn82zph1ag6d802z9vclivk9742367vfqv6vyn82zph1ag6d802z9vlatestvk9742367vfqv6vyn82zph1ag6d802z9vmessagingvk9742367vfqv6vyn82zph1ag6d802z9vtelegramvk9742367vfqv6vyn82zph1ag6d802z9v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.