tg-ws-proxy-telegram-socks5

Overall suspicious but not malicious. The core behavior matches a Telegram proxy skill, and data flows are proportionate, but install trust is weakened by third-party binaries/repo ownership mismatch and the documentation advises disabling Defender. Treat as medium risk, mainly supply-chain and host-security exposure rather than credential theft.