Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Telegram Bot helper that openly uses curl and a bot token to send/query Telegram messages, with some documentation scope and safety-warning gaps but no hidden or deceptive behavior found.
Install only if you are comfortable letting an agent use your Telegram Bot token to make live Telegram API calls. Review destinations and content before sending, avoid uploading sensitive local files, keep the bot token in a protected environment variable or secret store, and be especially careful with message deletion, invite links, and webhook-reset commands.
The manifest description limits the skill to a narrower set of Telegram actions: 文本/图片/文件/投票发送, 聊天信息查询, and 基础Bot命令管理. However, the body of the skill advertises and instructs use of additional operational capabilities including 位置发送, 消息转发, 消息编辑, 消息删除, and 邀请链接 management, which materially expands the declared behavior.
The skill enables transmission, forwarding, deletion, invite-link operations, and chat/member queries against a live messaging platform without prominent privacy, authorization, or data-impact warnings. In an agent context, that increases the risk of users or downstream automations sending sensitive data externally, querying chat metadata, or performing destructive actions without informed consent.
The core documentation establishes a generic mechanism for making authenticated requests to Telegram's API endpoint using a bot token. That creates a standing external communication channel which, in an agent skill, can be used to transmit user data or operational metadata off-platform.
本工具箱封装 Telegram Bot API 的基础消息能力，让 AI Agent 能够通过 REST API 发送文本、图片、文件、位置、投票与转发消息，查询聊天信息，并管理 Bot 命令。免费版聚焦"能发能查"——覆盖 6 类基础消息发送与聊天信息读取；批量操作、群组管理、审核与 Webhook 等进阶能力留给专业版。
Telegram Bot API 使用 HTTP REST 接口，所有请求通过 `https://api.telegram.org/bot<TOKEN>/<METHOD>` 调用，响应为 JSON 格式。
## 核心能力
This example sends deployment information externally to Telegram, which can expose internal release timing, version numbers, or environment status. The danger is elevated by the skill's direct exec/curl usage and lack of embedded safeguards around content sensitivity or destination verification.
用户说"部署完成后通知 Telegram 群"。Agent 调用 sendMessage 发送文本消息到指定群组，包含版本号与状态。
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
This example sends deployment information externally to Telegram, which can expose internal release timing, version numbers, or environment status. The danger is elevated by the skill's direct exec/curl usage and lack of embedded safeguards around content sensitivity or destination verification.
用户说"部署完成后通知 Telegram 群"。Agent 调用 sendMessage 发送文本消息到指定群组，包含版本号与状态。
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Sending photos by URL to Telegram is an external disclosure path and may expose proprietary reports or internal images. If the URL itself is private, the action may also reveal internal resource locations or cause Telegram to fetch externally hosted content.
用户说"把这张周报图表发到 Telegram"。Agent 调用 sendPhoto 发送图片，附带说明文字。
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendPhoto" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Poll creation is also an external transmission, though usually lower sensitivity than arbitrary message content. The main risk is unintended disclosure of internal planning priorities or organizational information to an external chat.
用户说"在群里发起投票问下个版本优先做什么"。Agent 调用 sendPoll 发送原生投票。
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendPoll" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Using getUpdates retrieves chat activity and metadata from Telegram, which is a two-way external data exchange rather than a purely local action. It may collect user messages, chat identifiers, and other metadata without clear privacy guidance, increasing exposure in agent workflows.
# 先将 Bot 加入群组，然后在群中发一条消息
curl "https://api.telegram.org/bot{{BOT_TOKEN}}/getUpdates" | jq '.result[-1].message.chat.id'
This sendMessage example is another explicit egress path to Telegram. In the skill context, it is intended behavior, but still security-relevant because an agent may forward sensitive user-provided data or system-generated content outside the local environment.
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "CHAT_ID",
This sendMessage example is another explicit egress path to Telegram. In the skill context, it is intended behavior, but still security-relevant because an agent may forward sensitive user-provided data or system-generated content outside the local environment.
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "CHAT_ID",
This example includes a realistic-looking bot token in an environment-variable export, which normalizes handling a sensitive credential in plaintext command examples. Even if illustrative, bot tokens are equivalent to passwords for the bot and can be copied into shell history, screenshots, logs, or unsafe reuse by operators.
export TELEGRAM_BOT_TOKEN="123456789:ABCdefGHIjklMNOpqrSTUvwxYZ"
curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage"
-H "Content-Type: application/json"
-d '{"chat_id": "-1001234567890", "text": "Test message"}'
Rich-text sendMessage examples still transmit content to Telegram and may include links or structured internal data. The skill provides no built-in constraints to prevent an agent from sending sensitive formatted reports externally.
# Markdown 格式
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Rich-text sendMessage examples still transmit content to Telegram and may include links or structured internal data. The skill provides no built-in constraints to prevent an agent from sending sensitive formatted reports externally.
# Markdown 格式
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
HTML-formatted messages are another outbound content channel to Telegram. The formatting support increases expressiveness but also the chance of packaging internal status, links, or code fragments into externally delivered messages.
}'
# HTML 格式
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Interactive message examples with inline keyboards still transmit data externally and can influence user actions in Telegram. If used carelessly, they can send workflow controls or approval prompts outside the organization without sufficient review.
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendMessage" \
-H "Content-Type: application/json" \
-d '{
"chat_id": "-1001234567890",
Setting bot commands is an authenticated external API action against Telegram. While typically low sensitivity, it alters bot behavior visible to users and should still be treated as a remote state-changing operation.
# 设置命令列表
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/setMyCommands" \
-H "Content-Type: application/json" \
-d '{
"commands": [
Fetching bot commands is an external API query. This is lower risk than sending arbitrary content, but it still discloses and depends on remote bot state and uses a sensitive token for authenticated access.
Uploading a document to Telegram is a clear external file transfer and may expose proprietary or sensitive files. Because the example uses local file upload with curl, there is a direct path for an agent or operator to transmit local filesystem contents off-system.
sendPhoto 会压缩图片。如需保持原始质量，改用 sendDocument 发送：
curl -X POST "https://api.telegram.org/bot{{BOT_TOKEN}}/sendDocument" \
-F "chat_id=-1001234567890" \
-F "document=@/path/to/image.png"
deleteWebhook is an authenticated remote state-changing request to Telegram. It is lower impact than arbitrary data exfiltration, but still modifies bot configuration externally and can disrupt integrations if run unintentionally.
getUpdates（长轮询）与 Webhook 互斥。若 Webhook 已设置，调用 getUpdates 返回 409 冲突。删除 Webhook 后才能使用长轮询：
curl "https://api.telegram.org/bot{{BOT_TOKEN}}/deleteWebhook"
The description and usage instructions consistently assume Chinese-language interaction without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.
The skill positions the free edition as excluding 频道管理 and similar advanced features, yet the chat ID format section explicitly documents channel targets using channel IDs or @username. That makes the documented operational scope broader and less consistent than the declared free-version limits.
The file repeatedly states that Webhook capabilities are reserved for the professional version, implying they are out of scope for the free skill. Yet the best-practices section directly instructs use of the Telegram deleteWebhook API, which is an operational webhook-management action and therefore contradicts the stated limitation.