CommunityOS

This package appears to be a full Telegram multi-bot framework and will need valid Telegram bot tokens and at least one LLM API key. Before installing or running it: - Inspect and reconcile env var names: the SKILL.md and the code use different variable names (e.g., TELEGRAM_BOT_TOKEN_PANDA vs PANDORA_TOKEN). Make sure you set the exact env vars the runtime expects to avoid misconfiguration. - Review admin/app.py and any code that starts a FastAPI/uvicorn server — understand what endpoints it exposes and whether it accepts incoming connections or sends data out. - Expect substantial dependency installation (langchain, chromadb, fastapi, etc.). Install and run this in an isolated environment (virtualenv or container) first. - Audit code paths that fetch URLs or call external API endpoints (broadcast API endpoints, indexer fetch) to confirm they do not send secrets. Limit tokens to least privilege and store them separately if possible. - Because the package reads a local .env, keep sensitive keys scoped and rotate them if you test with real credentials. - If you need higher assurance, run the init and start scripts in a sandbox VM or container, monitor network traffic, and open the admin server only on localhost or behind authentication. Overall: functionally coherent for its purpose, but the env-name mismatches and unspecified admin/network behaviors warrant caution and manual review before use.