Telegram File Sender

Send files or notes up to 50MB to a Telegram user via bot, supporting local, iCloud, relative, or Knowledge/ paths with automatic zipping if needed.

Security Scan

The skill's code and instructions align with its stated purpose (sending local files to Telegram via an OpenClaw bot); there are a few small implementation/documentation mismatches to be aware of but nothing that indicates malicious intent.

Purpose & Capability

Name/description match the included helper script and runtime instructions. The skill prepares a local file (optionally zips it) and relies on OpenClaw's message/send tool to actually call the Telegram API — this is coherent for a 'Telegram File Sender'. No unrelated credentials, binaries, or external endpoints are requested by the skill.

Instruction Scope

Instructions are narrowly scoped: run the bundled Python helper to prepare a file, parse its output, call the platform's message tool to send the file, then delete temp files. However, two minor mismatches should be noted: (1) SKILL.md mentions support for '~' and iCloud paths and 'workspace isolation', but the script does not call os.path.expanduser() or perform explicit workspace-restriction checks; it will accept any path that exists on disk. (2) The script can read and copy any file the agent is asked to send — this is expected behavior but means the agent (and the user) must ensure they don't inadvertently send sensitive local files.

Install Mechanism

This is an instruction-only skill with a small helper script included (no install spec). That is low risk. The SKILL.md invokes 'python3' but the registry metadata did not declare python3 as a required binary; platforms that lack python3 would fail. No network downloads or archive extraction are performed.

Credentials

The skill declares no environment variables or secrets. It relies on OpenClaw's server-side Telegram bot configuration (accountId) which is appropriate. The script has a hardcoded default account_id ('CyreneAssistant_bot') if none is provided — users should verify that default or pass the intended accountId.

Persistence & Privilege

The skill does not request permanent presence (always:false), does not modify other skills or system-wide configuration, and does not require elevated privileges. It creates temporary files under a temp directory and instructs the agent to delete them after sending.

Assessment

This skill appears to do what it says, but review these practical points before installing or using it: - Ensure you trust the agent with local files: the script will read any file path you provide and prepare it for sending (no built-in checks prevent sending sensitive files). - Check which bot account will be used: the script defaults to 'CyreneAssistant_bot' if you don't pass accountId. Confirm OpenClaw's configured accountId(s) before sending. - The SKILL.md mentions '~' expansion and workspace isolation, but the included script does not expand '~' nor enforce workspace boundaries; the agent or caller should expand user paths and enforce directory restrictions if needed. - Confirm python3 is available on the runtime host since the instructions call 'python3' (the metadata did not declare python3 as required). - Temporary files are removed on the normal success path, but if the message tool fails or the agent crashes, tmp files may remain — monitor and clean /tmp as needed. - If you need stricter controls (prevent sending files outside a specific workspace or blocking certain extensions), request those checks be added to the helper or enforced by platform policies.

Send files to a Telegram user via bot, handling workspace path restrictions and Telegram's 50MB file size limit.

What This Skill Does

This skill enables an AI agent to send files from the local filesystem (including iCloud Drive paths) to a Telegram user through a bot account. It handles:

• Path resolution: Accepts iCloud paths and local absolute paths
• Size limits: Telegram caps documents at 50MB; this skill auto-compresses files over that limit
• Workspace isolation: Files outside allowed directories are copied to a temporary location before sending
• Multiple bots: Supports any bot accountId configured in OpenClaw

When to Use This Skill

• User asks to "send me the file" or "发给我"
• User wants a note or document forwarded to Telegram
• User requests a specific file be delivered via the bot
• Any request that involves transferring a file from the agent's filesystem to Telegram

Prerequisites

The agent must have:

1. A configured Telegram bot account in OpenClaw
2. The target user's Telegram chat ID
3. The file path (or enough info to locate the file)

If any of these are missing, ask the user before proceeding.

Core Workflow

Step 1: Identify the File

If the user didn't specify a path, ask them.
Accepted formats:

• Any absolute path: /Users/you/Documents/file.any
• Path with ~ expansion: ~/path/to/file
• Relative path from workspace root
• Any file extension (.md, .txt, .pdf, .zip, images, etc.)

Step 2: Run the Helper Script

python3 skills/telegram-send-file/scripts/send_file.py "<source_path>" "<target_user_id>" [caption] [accountId]

Arguments:

Arg	Required	Default	Description
source_path	Yes	—	Absolute path to the file
target_user_id	Yes	—	Telegram chat ID (e.g. 123456789)
caption	No	""	Text caption shown before the file
accountId	No	(first bot)	Bot accountId configured in OpenClaw

Step 3: Parse Script Output

The script outputs key-value lines on stdout:

SEND_PATH=/tmp/xyz/file.md
SEND_FILENAME=file.md
TARGET=123456789
CAPTION=📄 My Document
ACCOUNT_ID=your_bot_account
READY

Extract SEND_PATH, TARGET, ACCOUNT_ID from the output.

Step 4: Send via Message Tool

{
  "action": "send",
  "channel": "telegram",
  "target": "<TARGET from output>",
  "accountId": "<ACCOUNT_ID from output>",
  "filePath": "<SEND_PATH from output>",
  "asDocument": true
}

Use filePath (absolute path), not path or relative paths.

Step 5: Clean Up Temp Files

After message tool returns ok: true, delete the temp file:

rm <SEND_PATH>
rm -rf <parent_tmp_dir>

Size Handling Rules

File size	Behavior
≤ 50MB	Copied to tmp, sent as-is
> 50MB	Auto-zipped; sent if result ≤ 50MB
> 50MB after zip	Prints FAIL + suggestion; does not send

The suggestion will be either:

• "Split the file into smaller parts"
• "Send a summary + external link"

Common Usage Patterns

Send Any File Type

python3 skills/telegram-send-file/scripts/send_file.py \
  "/Users/you/Documents/report.pdf" \
  "123456789" \
  "📄 Report" \
  "your_bot_account"

Works with any extension: .md, .txt, .pdf, .zip, .png, .jpg, .json, etc.

Send a Large File (Auto-zipped)

If a file exceeds 50MB, the script auto-zips it. If the zip is ≤ 50MB, it sends the zip automatically.

Send from a Different Bot

python3 skills/telegram-send-file/scripts/send_file.py \
  "/Users/you/path/to/file.png" \
  "123456789" \
  "🖼 Image" \
  "another_bot_account"

Edge Cases

File Not Found

The script exits with FAIL: Source file not found. Ask the user to verify the path.

Permission Denied

If the file exists but cannot be read, the script will fail. Check file permissions.

Empty File

Allowed. The script sends it normally.

Binary File

Allowed. The script handles any file type, not just text.

Very Long Filename

Telegram handles filenames up to 255 chars. The script preserves the original basename.

Security Notes

• Files are only copied to tmp and deleted after sending
• No external command execution (uses Python's built-in zipfile module only)
• Only OpenClaw's Telegram bot credentials are used (configured server-side)
• The script does not log or persist file contents

Debugging

If sending fails:

1. Check file size: ls -lh <path>
2. Verify path exists: ls <path>
3. Test temp copy manually: cp <path> /tmp/
4. Check bot config: Confirm accountId is correct in OpenClaw config
5. Check user ID: Confirm the target chat ID is correct

Relationship to OpenClaw Message Tool

This skill wraps the message tool's send action with file-document support. The workflow is:

1. Helper script prepares the file and resolves path/size
2. Agent calls message tool with the prepared absolute path
3. OpenClaw handles the Telegram API call

The skill exists because:

• OpenClaw requires absolute paths for file sending
• Files may need to be copied from iCloud to a reachable location
• Size limits require compression as a pre-processing step