Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Telegram Import

v1.0.0

Incrementally import Telegram messages from SQLite to LanceDB with Qwen3-Embedding-4B vectors, supporting checkpoint resume and filtering empty messages.

0· 76·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lulu-owo/telegram-import.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Telegram Import" (lulu-owo/telegram-import) from ClawHub.
Skill page: https://clawhub.ai/lulu-owo/telegram-import
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install telegram-import

ClawHub CLI

Package manager switcher

npx clawhub@latest install telegram-import
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (Telegram -> LanceDB with Qwen3 embeddings) matches the code and SKILL.md. The script reads a local SQLite DB, generates embeddings from a local LM Studio endpoint, and writes to a local LanceDB dataset. No unrelated credentials, remote APIs, or unrelated binaries are requested.
Instruction Scope
Instructions and the script operate on local files and the local LM Studio endpoint (127.0.0.1). They reference explicit Windows paths (D:\...) and the checkpoint file. The script reads the SQLite DB and writes to LanceDB and a checkpoint; it does not contact external domains beyond localhost. Note: the SKILL.md and script assume specific absolute paths which may not exist on a user's machine and will cause failures if paths are different.
Install Mechanism
No install spec is provided (instruction-only plus an included script). The script imports third-party Python packages (requests, numpy, pyarrow, lance). The absence of an install spec is not incoherent, but users must manually ensure these dependencies are installed; missing guidance could lead to runtime errors.
Credentials
No environment variables, credentials, or external tokens are required. The only network call is to http://127.0.0.1:1234 (local LM Studio), which is proportional to producing embeddings.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only writes its own checkpoint and the LanceDB dataset at the configured paths. It does perform persistent writes to the filesystem (checkpoint and dataset) as expected for an importer.
Assessment
This skill is coherent with its stated purpose, but review these before running: 1) Paths: the script hardcodes Windows paths (e.g., D:\chat\telegram_messages.db and D:\edata.lance). Update them if your files live elsewhere or run in an environment that matches these paths. 2) Dependencies: install the required Python packages (requests, numpy, pyarrow, lance) in a controlled virtual environment. 3) Local embedding service: the embedding endpoint is http://127.0.0.1:1234 — ensure LM Studio (or another compatible service) is running locally and you trust it. 4) Checkpoint safety: the script uses pickle.load to read the checkpoint file; unpickling untrusted files can execute arbitrary code. Only reuse checkpoints you created/trust; if you expect untrusted inputs, replace pickle with a safe format (JSON) or validate the checkpoint file before loading. 5) Backups & permissions: the script will read your Telegram DB and write into the LanceDB directory; back up data and run with appropriate filesystem permissions. If you want higher assurance, inspect and test the script in an isolated VM or container before running on sensitive data.

Like a lobster shell, security has layers — review code before you run it.

latestvk9716334gvnt0xb3xap0nnje5184bn90
76downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

telegram-import Skill

将 Telegram 消息从 SQLite 数据库增量导入 LanceDB 向量库。

数据源

  • DB: D:\chat\telegram_messages.db
  • : telegram_messages
  • 字段: id, group_name, group_id, message_id, date, sender_id, sender_name, message, matched_keywords, is_reply, media_type, has_6_digit_number, created_time

目标存储

  • LanceDB: D:\edata.lance
  • Checkpoint: D:\edata.lance\temp\telegram.ckpt(pickle 格式,断点续传)

Schema

字段类型说明
idstringtelegram:{group_id}:{message_id}
textstring消息文本
vectorfloat[2560]Qwen3-Embedding-4B 向量
categorystring固定 telegram
scopestring固定 shared
importancefloat固定 0.5
timestampint消息时间戳(Unix)
metadatastringJSON:group_name, group_id, message_id, sender_id, sender_name, matched_keywords, is_reply, media_type, has_6_digit_number

Embedding

  • LM Studio: http://127.0.0.1:1234/v1/embeddings
  • Model: text-embedding-qwen3-embedding-4b
  • 维度: 2560

执行命令

python.exe "C:\Users\admin\.openclaw\workspace\skills\telegram-import\scripts\chunk_db.py" telegram

增量逻辑

  1. 启动时加载 telegram.ckpt 恢复 seen_keyslast_idx
  2. last_idx + 1 继续扫描 DB
  3. 跳过 seen_keys 中已存在的 key
  4. 过滤空消息(message 为 NULL 或空字符串)
  5. 每 500 行保存一次 checkpoint

Comments

Loading comments...