skills/qwibitai/nanoclaw/add-telegram/Gen Agent Trust Hub

add-telegram

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches and merges code from the author's GitHub repository at https://github.com/qwibitai/nanoclaw-telegram.git. This is a vendor-owned resource used to provide the Telegram channel implementation.
  • [COMMAND_EXECUTION]: The skill executes system-level commands to manage the integration, including environment variable configuration and service restarts using launchctl or systemctl. It also uses npx to execute local setup scripts and npm for dependency management.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface as the agent is designed to process external messages from the Telegram channel.
  • Ingestion points: External messages are received and processed via src/channels/telegram.ts.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to treat incoming message content as untrusted data.
  • Capability inventory: The agent has access to file system operations, package management, and service control commands through the skill's implementation.
  • Sanitization: There is no evidence of sanitization or validation logic for the content of incoming Telegram messages in the provided skill definition.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 02:35 PM