Subdomain Bot Config

Set up a custom domain and Telegram Bot for a Mobazha store. Use when the user wants to configure DNS, TLS, or a Telegram Mini App storefront.

Security Scan

The skill's purpose and steps match each other, but the runtime instructions tell the user/agent to run a remote installer (curl | sudo bash) without verification and rely on manual handling of bot tokens — this is coherent but high-risk and not sufficiently constrained.

Purpose & Capability

Name/description (domain + Telegram bot setup for a Mobazha store) align with the commands and steps in SKILL.md (DNS records, mobazha-ctl, mobazha start, BotFather flow). The requested capabilities are proportional to the stated purpose (no unrelated credentials or binaries are requested).

Instruction Scope

SKILL.md instructs executing network-fetched install commands (curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain ...) and running admin commands that require elevated privileges. There is no guidance to verify the downloaded script (no checksum or signature), and though the doc says to ask for explicit consent before accepting tokens, it leaves agent behavior open-ended. These instructions give broad authority to execute remote code and handle secrets, which is out-of-band risk for an instruction-only skill.

Install Mechanism

There is no formal install spec, but the documented installation method (pipe a remote script into sudo bash from get.mobazha.org) is equivalent to downloading and executing arbitrary code from the network without checksum/signature. Even if get.mobazha.org is the project's host, lack of verification and use of a single-line pipe makes the flow a high-risk install mechanism.

Credentials

The skill does not request environment variables or credentials in metadata (proportionate). However, the runtime instructions expect the operator/agent to accept and use a BotFather token for configuration. The doc warns not to store or transmit tokens, but there is no technical enforcement; users/agents might be asked to paste tokens into chat or run commands that consume them. This is a potential sensitive-data handling risk even though no env vars are declared.

Persistence & Privilege

The skill is user-invocable and not always-on; it does not request persistent privileges or modification of other skills' configs. There is no install-time persistence declared by the skill itself. The only persistence risk arises from the remote installer it recommends (which could write long-lived services on the host).

What to consider before installing

This skill appears to do what it says (set up DNS/TLS and connect a Telegram bot), but exercise caution before running any of the commands. Key risks and actions: - Avoid piping unknown scripts to sudo bash. Instead, download the installer, inspect it, and verify checksums/signatures (ask the vendor for release hashes) before executing. Consider running it in an isolated VM or container first. - Confirm you trust get.mobazha.org (project homepage or repository) — the skill metadata lacks a source/homepage. Ask the publisher for a canonical repository or release page. - Do not paste BotFather tokens or other secrets into untrusted chat windows. If an agent asks you for a token, prefer manual entry into the store admin panel rather than sharing it in conversation. - If you must use this skill, ask the maintainer for safer installation options (package with checksums, signed releases, or an audited installer) and clear instructions for secure token handling. If you want, I can: (a) produce a safer install checklist you can follow, (b) draft specific verification steps to validate the installer, or (c) suggest exact questions to ask the skill author/maintainer before proceeding.

Subdomain & Telegram Bot Configuration

Set up a custom domain for your Mobazha store and connect a Telegram Bot for your storefront Mini App.

Part A: Custom Domain Setup

For Docker Standalone Stores

If you deployed with the Docker standalone installer:

Option 1: Set domain during installation

curl -sSL https://get.mobazha.org/standalone | sudo bash -s -- --domain shop.example.com

Option 2: Add domain to an existing store

1. Point your domain's DNS A record to the VPS IP address
2. Wait for DNS propagation (usually 1-5 minutes)
3. Run:

mobazha-ctl set-domain shop.example.com

The store automatically obtains a TLS certificate from Let's Encrypt.

For Native Binary Stores

Start (or restart) with the domain flag:

mobazha start --domain shop.example.com

DNS Setup

At your domain registrar (Cloudflare, Namecheap, GoDaddy, etc.), create an A record:

Type	Name	Value	TTL
A	shop (or @)	<VPS_IP>	Auto / 300

If using a subdomain like shop.example.com, the "Name" field should be shop. If using the root domain example.com, the "Name" field should be @.

Verify

After DNS propagation:

# Check DNS resolution
dig +short shop.example.com

# Check HTTPS
curl -sI https://shop.example.com | head -5

Part B: Telegram Bot Setup

Mobazha stores can be accessed as a Telegram Mini App via a Telegram Bot. This lets buyers browse and purchase directly inside Telegram.

Step 1: Create a Bot with BotFather

1. Open Telegram and message @BotFather
2. Send /newbot
3. Choose a display name (e.g., "My Store")
4. Choose a username (e.g., my_store_bot) — must end with bot
5. BotFather will reply with a Bot Token — save it securely

Step 2: Configure the Mini App URL

Tell BotFather where your store frontend lives:

1. Send /mybots to BotFather
2. Select your bot
3. Choose Bot Settings → Menu Button
4. Set the URL to your store:
   • SaaS store: https://app.mobazha.org/tma?store=<your-peer-id>
   • Standalone store: https://shop.example.com/tma

Step 3: Configure the Bot in Your Store

In your store admin panel:

1. Go to Admin → Settings → Telegram
2. Enter the Bot Token from BotFather
3. Save

This enables:

• Order notifications in Telegram
• Buyer can message you through the bot
• Mini App storefront accessible via the bot's menu button

Step 4: Set Bot Description & Photo

Back in BotFather:

1. Send /mybots → select your bot
2. Edit Bot → Edit Description: describe your store
3. Edit Bot → Edit About Text: short store summary
4. Edit Bot → Edit Botpic: upload your store logo

Step 5: Share Your Bot

Your Telegram storefront is now live at:

https://t.me/<bot_username>

Share this link anywhere — buyers tap the menu button to open your Mini App store.

Credential Handling

• Ask for explicit user consent before connecting to any server or entering credentials
• If the user shares a BotFather token, use it only for the immediate configuration task
• Never store, log, or display credentials after use
• Remind the user to keep tokens and passwords private
• The agent must not transmit credentials to any party other than the intended target