Telegram Bot

Create and manage Telegram bots. Use when user wants to build a Telegram bot for notifications, automation, customer support, group management, or interactiv...

Security Scan

The skill's code and instructions match its stated purpose (creating/running Telegram bots); nothing requests unrelated credentials or hidden endpoints, though it will install a dependency at runtime and will execute any handler file you point it at.

Purpose & Capability

Name/description align with the provided SKILL.md, examples, and scripts/bot.py. The script requires a Telegram bot token (passed as an argument) and implements expected features (commands, handlers, webhook/polling). No unrelated services, credentials, or binaries are requested.

Instruction Scope

SKILL.md stays within the Telegram Bot domain: creating a bot via @BotFather, obtaining a token, choosing polling or webhooks, and running the included script. It does instruct running python scripts and loading a user-supplied handler file; loading that handler will execute arbitrary Python code from the provided path (expected for custom handlers but a sensible security consideration).

Install Mechanism

There is no formal install spec in the registry, but scripts/bot.py attempts to pip-install python-telegram-bot at runtime via os.system("pip install ...") if the package is missing. This is a network installation from PyPI performed without virtualenv isolation and using a shell call, which is common but worth noting for reproducibility and security.

Credentials

The skill does not request environment variables or unrelated credentials. The only secret required is the Telegram Bot API token, which the script expects as a command-line argument — proportionate to the skill's purpose.

Persistence & Privilege

The skill is not always-enabled and does not request system-wide privileges or modify other skills' configs. It does import and run code (the handler) you provide at runtime, but that is part of its normal operation.

Assessment

This skill appears to do what it says, but take these precautions before running it: - Keep your Telegram bot token secret and pass it only to trusted environments; treat it like a password. - The script will attempt to pip-install python-telegram-bot at runtime using os.system — run it inside a virtual environment or container to avoid polluting system Python and to review the package version. - The --handler option imports and executes whatever Python file you point it to; do not use untrusted handler files (they can run arbitrary code, access files, or send data). Review handler code before running. - If you use webhook mode, ensure your webhook endpoint is secure (HTTPS) and exposed only as needed. - Because the skill's source/homepage is unknown, prefer running it in an isolated environment until you've audited the code and any runtime installations.

Create and manage Telegram bots using the Bot API.

Quick Start

# Get bot token from @BotFather on Telegram
# Create bot.py:
python scripts/bot.py --token YOUR_TOKEN --handler my_handler.py

Bot Creation Steps

1. Open Telegram, search for @BotFather
2. Send /newbot to create new bot
3. Get API token
4. Configure webhooks or polling

Core Features

• Commands: /start, /help, /settings
• Callbacks: Inline buttons, queries
• Groups: Admin tools, filters
• Webhooks: Receive updates via HTTP

Script Usage

python scripts/bot.py [OPTIONS]

Options:
  --token TEXT        Bot API token (required)
  --handler PATH      Python handler file
  --webhook-url URL   Webhook endpoint URL
  --port PORT         Webhook server port (default: 8443)
  --poll              Use long polling instead of webhook

Handler Format

# my_handler.py
def handle_update(update, context):
    """Handle incoming updates."""
    if update.message:
        text = update.message.text
        if text == "/start":
            context.bot.send_message(
                chat_id=update.message.chat_id,
                text="Hello! I'm your bot."
            )

Examples

See references/examples.md for:

• Echo bot
• Inline keyboard bot
• Group admin bot
• Notification bot
• Weather bot