Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Telegram Group Chat Setup
v1.0.0Configure a MoltBot agent to participate in a Telegram group chat. Automates adding the group to the allowlist, setting mention patterns, and configuring sender permissions — all via a single gateway config patch. Use when the user wants to set up their bot in a Telegram group, enable cross-bot communication, or configure group mention gating.
⭐ 0· 1.6k·0 current·0 all-time
by@arekqq
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name/description match what it actually does: detect bot identity, build mention patterns, and patch the gateway config. Reading the gateway config to find a Telegram bot token and calling api.telegram.org/getMe is expected for auto-detection.
Instruction Scope
SKILL.md instructs reading the gateway config and calling Telegram's API (expected). However the runtime instructions and included script assume availability of curl and python3 even though required binaries were not declared. The script reads a local config file (CLAWDBOT_CONFIG_PATH or $HOME/.clawdbot/moltbot.json) and uses that token — this is necessary for the task but is sensitive behavior and should be documented to the user.
Install Mechanism
Instruction-only skill with a small helper script; there is no download or installation step and no remote install URLs. This is low-risk from an install perspective.
Credentials
The skill reads a Telegram bot token from the local MoltBot config file — this is proportionate to its purpose. It does not request unrelated credentials or environment variables. Caveat: the script will embed the token into an HTTP URL passed to curl, which can expose the token to other local users via the process list; the skill also implicitly relies on CLAWDBOT_CONFIG_PATH behavior which is not documented in SKILL.md.
Persistence & Privilege
always:false and no special persistence is requested. The skill patches the gateway config (expected for this purpose) but does not attempt to modify other skills or system-wide settings outside the gateway config.
Assessment
This skill appears to do what it claims, but review these points before installing or running it: 1) It reads your MoltBot config (default $HOME/.clawdbot/moltbot.json or CLAWDBOT_CONFIG_PATH) to extract the Telegram bot token — ensure you trust the skill and back up your config. 2) The included script uses curl and python3 even though the skill metadata doesn't list required binaries; make sure those tools are available and run the script under an account with appropriate permissions. 3) The script invokes curl with the token in the URL (https://api.telegram.org/bot<TOKEN>/getMe) which can expose the token to other local users via the process list; consider running it in a safe environment or modifying it to use a POST with token in headers or use a socket-based API. 4) The SKILL.md relies on a 'gateway' CLI to get/patch config and restart the gateway — confirm the exact commands and behavior on your system, and review merge logic before applying patches to avoid accidental overwrites. 5) There is no upstream homepage or publisher information — if you need a higher trust level, ask the author for provenance or a signed release. If you want, I can: (a) produce a safer version of the script that avoids exposing the token on the process list, (b) draft a checklist of commands to run manually, or (c) walk through the exact config patch merge steps to safely apply changes.Like a lobster shell, security has layers — review code before you run it.
latestvk979m502rb40nvnpxdyrqzwkt580ezda
License
MIT-0
Free to use, modify, and redistribute. No attribution required.