Telegram Media Resolver

• Analyzed: May 12, 2026, 3:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1c5c2f866450d1cd54e72cf5403c13362fb53c768512c3ef81c3f1a60f48a002
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to resolve Telegram media placeholders by downloading files via the Telegram Bot API. It requires reading the `botToken` from the OpenClaw configuration (`~/.openclaw/openclaw.json`) as instructed in `SKILL.md`, and the `scripts/fetch_media.py` script uses this token to interact with `api.telegram.org` and download files to a specified output directory (defaulting to `/tmp`). While this involves network access, file system writes, and handling a sensitive API token, these actions are directly necessary and aligned with the skill's stated purpose. There is no evidence of intentional harmful behavior such as unauthorized data exfiltration, persistence mechanisms, or broader prompt injection attempts beyond retrieving the required token for its function.