Telegram Marketing Audit Adarsh

Handles Telegram /marketing_audit command by running a marketing audit on an Instagram handle or website domain and returning the report.

Security Scan

This skill is a simple Telegram command handler that delegates work to a separate 'marketing-orchestrator' skill — the handler itself is small and plausible, but it references required collector API keys without declaring them and relies on an external skill you can't inspect, so review the orchestrator and its credential needs before installing.

Purpose & Capability

The name/description match the implementation: this is a Telegram slash-command handler that forwards the instagramHandle/websiteDomain to a 'marketing-orchestrator' skill and returns a report. There are no unrelated binaries or surprising actions in the handler itself.

Instruction Scope

SKILL.md contains only a short handler that validates args, replies to the user, and calls context.callSkill('marketing-orchestrator'). That scope is appropriate for a thin command handler. The handler delegates all collection and network work to the orchestrator, so the real behavior depends on that other skill.

Install Mechanism

Instruction-only skill with no install spec and no code files beyond a small handler snippet; nothing is downloaded or written to disk by this skill itself.

Credentials

The SKILL.md explicitly tells operators to "Ensure environment variables for collectors (API keys) are set," yet the registry metadata declares no required env vars. Because this skill delegates to an external 'marketing-orchestrator', required credentials are likely needed by that other skill — this mismatch (no declared env but a textual instruction to set keys) is a red flag: you should inspect the orchestrator to see exactly which secrets it needs.

Persistence & Privilege

No elevated persistence requested (always:false). Default autonomous invocation is allowed but appropriate for a user-invocable handler; the skill does not request cross-skill config writes or system-wide changes.

What to consider before installing

This handler itself is small and plausible, but it does not perform the audits — it calls a separate 'marketing-orchestrator' skill. Before installing: (1) locate and review the marketing-orchestrator skill's code/manifest to see what network/API calls and environment variables (API keys, tokens) it requires; (2) verify any requested API keys are minimal and only for services you expect (Instagram, analytics providers, etc.); (3) avoid providing broad credentials (AWS/GCP root keys, unrelated service tokens) unless you understand why they're needed; (4) register the Telegram slash command in a test environment first and run audits with dummy inputs to confirm behavior; and (5) prefer installing only if you can audit the orchestrator or it comes from a trusted source. If you cannot review the orchestrator, treat this skill as risky because it grants a pathway to whatever the orchestrator does.

Telegram Marketing Audit Command Handler Skill

Purpose

Handles the Telegram /marketing_audit command by triggering the Marketing Orchestrator skill with given input and replying with the final report.

Telegram Command

• Command: /marketing_audit
• Args: instagramHandle (optional), websiteDomain (optional)

Implementation

module.exports = async function marketingAuditHandler(context) {
  const { instagramHandle, websiteDomain } = context.args;

  if (!instagramHandle && !websiteDomain) {
    await context.reply("Please provide an Instagram handle or website domain (or both).");
    return;
  }

  await context.reply("Starting marketing audit. This may take a few minutes...");

  try {
    const result = await context.callSkill("marketing-orchestrator", {
      instagramHandle,
      websiteDomain,
    });

    if (result && result.reportMarkdown) {
      await context.reply(result.reportMarkdown);
    } else {
      await context.reply("Audit completed but no report was generated.");
    }
  } catch (err) {
    await context.reply("Error during marketing audit: " + err.message);
  }
};

Notes

• Add this skill folder to OpenClaw skills directory.
• Register a Telegram slash command /marketing_audit that uses this skill as the handler via OpenClaw config or ClawHub.
• Ensure environment variables for collectors (API keys) are set.