telegram-automation

SUSPICIOUS. The skill’s capabilities mostly match its stated Telegram automation purpose, and there is no evidence of malware or an unverified downloaded binary. However, all operations and bot-auth setup are routed through a third-party MCP/intermediary instead of direct Telegram API endpoints, and the skill enables autonomous external actions like messaging, deleting, forwarding, and invite-link creation. This is a coherent integration but carries meaningful trust and action-scope risk.