Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Telegram Group Onboard
v1.2.0Automatically onboard new Telegram groups so the bot responds immediately — with project setup. Use when: (1) a user says they're creating a new Telegram gro...
⭐ 0· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the implementation: the SKILL.md describes watching gateway logs for dropped Telegram messages and the included bash script edits openclaw.json to add the group. Creating project files for the group is consistent with the feature. No requested env vars, binaries, or external services are out of scope.
Instruction Scope
The instructions tell the operator to read gateway logs (/tmp/openclaw/openclaw-*.log), use jq to parse JSON, and edit or hot-reload server config. Reading those logs and the openclaw.json config is necessary for the task but is sensitive (they can contain other metadata). The flow also suggests using ssh/scp for remote servers, which is expected for admin ops but requires appropriate server access and care.
Install Mechanism
No install spec — the skill is instruction-only plus a small shell script. Nothing is downloaded or written by an installer, minimizing install-time risk.
Credentials
The skill requests no environment variables or credentials. It does rely on typical admin tools (ssh/scp, jq) but does not demand unrelated secrets. Note: remote execution requires the user to provide server credentials at runtime (ssh), but those are not requested or stored by the skill.
Persistence & Privilege
always is false and disable-model-invocation is default; the skill modifies only the OpenClaw config file(s) it locates (~/.openclaw/openclaw.json or /etc/openclaw/openclaw.json) and creates project files. It does not request permanent presence or attempt to change other skills' configs.
Assessment
This skill appears internally consistent with its purpose, but take these precautions before running it: (1) review the script (already included) and keep a copy of the backup file it creates — it will edit ~/.openclaw/openclaw.json or /etc/openclaw/openclaw.json; (2) ensure jq is installed and you have appropriate admin/SSH access to the server before using ssh/scp steps; (3) be aware of the security tradeoff if you switch to channels.telegram.groupPolicy: "open" (broader group access vs. allowlist); (4) when running the script on a remote server, copy it to a safe path (not world-writable /tmp) or inspect it first; (5) the SKILL.md references a separate "telegram-projects" flow — confirm how projects should be stored/managed in your deployment. If you want more assurance, test the flow in a staging environment or run the script manually after inspecting the target openclaw.json backup.Like a lobster shell, security has layers — review code before you run it.
latestvk975p62sm9xprmqrmc8d36x8hh844v11
License
MIT-0
Free to use, modify, and redistribute. No attribution required.