Telegram Topic Rename

Rename Telegram forum topics and change icons via Bot API. Use when user asks to name/rename a topic, change topic title, update topic icon, or says "命名这个topic", "给话题起个名", "换个图标". Requires TELEGRAM_BOT_TOKEN environment variable.

Security Scan

The skill appears to do what it claims (rename Telegram forum topics via the Bot API) but has metadata and dependency inconsistencies and a prompt-injection pattern in SKILL.md that warrant caution before installation.

Purpose & Capability

The skill's code and SKILL.md implement Telegram topic renaming and icon changes and legitimately require a TELEGRAM_BOT_TOKEN. However the registry metadata listed under 'Requirements' does not declare the TELEGRAM_BOT_TOKEN (and lists no required env vars), which is inconsistent with the stated purpose and included script.

Instruction Scope

Instructions are narrowly scoped to extracting chat/thread IDs from session context and calling the included shell script which calls the official Telegram Bot API. That's expected. Concerns: SKILL.md contains a detected 'unicode-control-chars' prompt-injection signal, and the runtime instructions/scripts assume local binaries (curl and jq) which the metadata does not declare.

Install Mechanism

No external install/downloads — the skill is instruction-plus-included script only, so nothing is fetched from arbitrary URLs. This is lower risk than remote installers.

Credentials

The only needed secret is TELEGRAM_BOT_TOKEN (appropriate for this function). But the skill metadata failed to declare this required environment variable or a primary credential, so the manifest and runtime requirements are inconsistent. The script does not request unrelated credentials.

Persistence & Privilege

always:false and normal autonomous invocation are used. The skill does not request persistent elevated privileges or modify other skills/configs.

Scan Findings in Context

[unicode-control-chars] unexpected: A prompt-injection pattern (unicode control characters) was detected inside SKILL.md. This is not expected for a simple Telegram rename tool and could indicate an attempt to manipulate prompts/evaluations or may be an accidental encoding artifact. Inspect the SKILL.md raw text before trusting it.

What to consider before installing

What to check before installing: - Confirm the owner/source: the skill claims to require TELEGRAM_BOT_TOKEN but the registry metadata omitted it — prefer skills whose manifest correctly lists required credentials. - Inspect the included script yourself: scripts/rename-topic.sh is bundled and performs curl to https://api.telegram.org/bot<token>/editForumTopic. Review it to ensure it matches your expectations. - Note required local tools: the script uses curl and jq but the manifest didn't declare them. Make sure these binaries exist or run in a controlled environment. - Treat TELEGRAM_BOT_TOKEN as a sensitive secret: only provide a bot token with minimal scopes and only if you trust the skill/owner. Consider creating a bot with restricted permissions for this purpose. - Investigate the unicode-control-chars finding in SKILL.md: open the file in a hex-aware editor or view raw bytes to confirm there are no hidden control characters or injected prompts. - If unsure, run the script manually from a safe environment (or container) rather than granting the skill broad autonomous execution rights; request the publisher to fix manifest inconsistencies before use.

Telegram Topic Rename / Telegram 话题命名

Rename Telegram forum topics and optionally change their icons.

重命名 Telegram 论坛话题，可选更换图标。

Setup / 配置

Set TELEGRAM_BOT_TOKEN in your environment or OpenClaw config:

在环境变量或 OpenClaw 配置中设置 TELEGRAM_BOT_TOKEN：

export TELEGRAM_BOT_TOKEN="your-bot-token"

Usage / 使用方法

Get topic info / 获取话题信息

Extract from session context:

• chat_id: User ID (private) or group ID
• thread_id: From message_thread_id or session key

从会话上下文提取：

• chat_id：用户 ID（私聊）或群组 ID
• thread_id：从 message_thread_id 或 session key 获取

Run the script / 运行脚本

# Rename only / 仅改名
scripts/rename-topic.sh <chat_id> <thread_id> "新名称"

# Rename + change icon (emoji shortcut) / 改名 + 换图标（emoji 快捷方式）
scripts/rename-topic.sh <chat_id> <thread_id> "新名称" 🤖

# Rename + change icon (full ID) / 改名 + 换图标（完整 ID）
scripts/rename-topic.sh <chat_id> <thread_id> "新名称" 5309832892262654231

# List available icons / 列出可用图标
scripts/rename-topic.sh --icons

Naming rules / 命名规则

• Length / 长度: ≤10 characters / 字符
• Style / 风格: Concise, capture the core theme / 简洁，抓住核心主题
• Auto-icon / 自动选图标: Match icon to topic theme (see references/icons.md)

Icon quick reference / 图标速查

Theme / 主题	Icon
AI / 机器人	🤖
Code / 编程	💻
Science / 科学	🔬
Work / 工作	💼
Notes / 笔记	📝
Chat / 闲聊	💬
Games / 游戏	🎮
Music / 音乐	🎵
Ideas / 想法	💡
Fire / 热门	🔥

Full list: See references/icons.md

完整列表：见 references/icons.md