Telegram Bot Builder

PassAudited by ClawScan on May 1, 2026.

Overview

This is an instruction-only Telegram bot helper; its sensitive areas like group management, webhooks, and payments are disclosed and aligned with its purpose.

This skill appears safe to install as an instruction-only helper. Before deploying any bot it helps create, review generated code, protect Telegram bot tokens, limit group/admin permissions, validate webhook traffic, and be especially careful with payment or moderation features.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If used to build a real bot, the user may be granting the bot power to interact with chats, groups, or payments.

Why it was flagged

Bot setup, group management, and payment features commonly require delegated Telegram bot authority, group permissions, or payment configuration, even though this artifact does not directly request credentials.

Skill content

- 🤖 Bot Setup (BotFather)
- 👥 Group Management
- 💰 Payment (Stars)

Recommendation

Use least-privilege bot permissions, keep bot tokens private, and review any generated bot code before deploying it to groups or payment flows.

Note

ASI07: Insecure Inter-Agent Communication

What this means

External Telegram messages could influence bot behavior if the generated implementation trusts webhook input too broadly.

Why it was flagged

Webhook and auto-reply functionality implies external inbound messages may trigger automated bot responses; this is expected for a Telegram bot builder but should be implemented with clear origin checks and limits.

Skill content

- 🔗 Webhook Integration
- 📩 Auto-reply / Filters

Recommendation

Validate webhook sources, avoid treating user messages as trusted instructions, and require explicit review for actions such as moderation, purchases, or account changes.