Telegram Alerts

Send formatted trading alerts, portfolio updates, and market signals via Telegram. Supports price alerts, stop-loss notifications, win/loss reporting, and sc...

Security Scan

The skill's instructions say it needs TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID, but the registry metadata claims no required environment variables — this mismatch is concerning even though the skill's behavior (sending Telegram alerts) itself is plausible.

Purpose & Capability

Name and description claim Telegram trading alerts, which justifies needing a Telegram bot token and chat id. However, the registry metadata declares no required environment variables or primary credential while SKILL.md explicitly says TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are required — the manifest and runtime instructions are inconsistent.

Instruction Scope

SKILL.md is instruction-only and only describes sending formatted alerts to Telegram and requiring two .env values. It does not instruct reading unrelated files or contacting other external endpoints, but the instructions are terse/vague (no explicit runtime commands) and rely on an out-of-band .env file for secrets.

Install Mechanism

No install spec and no code files — lowest-risk delivery model. Nothing will be downloaded or written by an installer according to the registry.

Credentials

The environment variables referenced in SKILL.md (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) are proportionate to sending Telegram messages. The concern is that the registry metadata does not declare these required credentials, so an automated permission review or user expecting a manifest-driven check could miss that secrets are needed or used.

Persistence & Privilege

always:false and no install behavior — the skill does not request permanent/system-level presence. disable-model-invocation is false (agent may call it autonomously), which is normal for skills; combine this with the metadata mismatch when deciding risk tolerance.

What to consider before installing

This skill appears to do what it says (send Telegram trading alerts) and legitimately needs a TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID, but the registry metadata does not list those environment variables — that discrepancy is the main red flag. Before using: 1) Ask the publisher to update the manifest to declare required env vars explicitly so reviewers and automated checks see them. 2) Use a dedicated Telegram bot token (do not reuse other tokens), and only give it the minimum permissions; consider creating a bot account just for alerts. 3) Store the token in a secure secret manager rather than plaintext .env if possible. 4) Be aware the agent can send messages autonomously (disable-model-invocation is false); ensure you trust the agent's triggers and the content it may send. 5) If you need stronger assurance, request the author provide explicit runtime commands or a minimal code sample so reviewers can confirm no other data is accessed or transmitted.

Telegram Alerts — Trading Notification System

Send rich trading alerts to Telegram for any crypto event or portfolio update.

Alert Types

• Trade alerts: entry/exit with P&L, entry price, stop, target
• Price alerts: trigger when asset crosses threshold
• Portfolio summaries: NAV, daily P&L, positions
• Stop-loss warnings: drawdown approaching limit
• Win/loss streaks: celebration + tilt prevention
• Scheduled reports: daily 18:00, weekly Monday

Usage

Use telegram-alerts to send a trade entry notification for BTC LONG at $68,000

Use telegram-alerts to send my daily portfolio summary

Use telegram-alerts to alert me when SOL breaks $90

Format Example

🟢 TRADE OPENED
Asset: BTC/USDT | LONG
Entry: $68,247 | Stop: $67,200 | Target: $70,000
Risk: $0.38 (0.05% NAV) | R:R = 1:2.6

Setup

Requires TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID in your .env file.