ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Telegram Interactive Buttons

v1.1.2

Create interactive Telegram messages with inline buttons using OpenClaw CLI. Use when you need user interaction in Telegram (selection from a list, confirmat...

⭐ 0· 317·1 current·1 all-time
by@netanelrotem
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
Skill claims to create interactive Telegram messages and all included files/scripts call only the OpenClaw CLI and local helpers (bash/python). Required binaries (openclaw, bash, optional python3) are appropriate for the stated purpose. However, SKILL.md metadata and documentation say a Telegram bot token is required (via OpenClaw config or env var) while the registry metadata lists no required env vars or primary credential — this mismatch should be clarified.
✓
Instruction Scope
Runtime instructions and helper scripts are limited to sending and editing messages via the openclaw CLI and validating JSON locally. The scripts reference the user's OpenClaw config (~/.openclaw/config.json) to store the bot token and do not read/write unexpected system files. The docs explicitly warn not to pass untrusted input to scripts.
ℹ
Install Mechanism
The skill is instruction-only (no install spec). It tells users to install the OpenClaw CLI via npm (a reasonable, standard instruction). There is no remote download/extract or hidden installer in the skill itself. Note: installing openclaw globally is done outside the skill and should be verified from an official source.
!
Credentials
The skill requires a Telegram bot token to operate (documented in SKILL.md and SETUP.md), but the registry metadata lists no required credentials. That inconsistency could lead users to miss provisioning the token or to supply it insecurely. Aside from the bot token, no other secrets are requested — the credential scope is otherwise proportionate.
✓
Persistence & Privilege
The skill does not request permanent platform-wide privileges (always: false). It asks the user to modify their OpenClaw config file to add the bot token, which is a reasonable configuration step for a messaging integration and does not modify other skills or global agent policies.
What to consider before installing
This skill appears to do what it says (send/edit Telegram messages with inline buttons), and included scripts are short and readable. Before installing or running anything: - Confirm how the Telegram bot token is expected to be supplied (SKILL.md/SETUP.md instruct editing ~/.openclaw/config.json or using an env var) — the registry metadata currently omits this requirement. Ask the publisher to fix the metadata if you rely on it. - Do not paste real bot tokens into example files; use environment variables or a secure config and add that file to .gitignore. - Review the scripts locally (they call openclaw only) and verify you have the official OpenClaw CLI (npm package source) before installing it globally. - Run examples in a safe/dev environment first (replace CHAT_ID placeholders). If you need agent-autonomous invocation enabled, remember the skill can be invoked by the agent by default — that increases blast radius if a token is stored insecurely. If the metadata mismatch concerns you, request an updated package manifest that explicitly lists the required credential (telegram_bot_token) and how it should be provided.

Like a lobster shell, security has layers — review code before you run it.

latestvk974703sjp0h4q4bjnd55gnztn82jgt6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsopenclaw, bash

Comments