Signallink

Forward trading alerts and webhook events from TradingView to Telegram instantly. No subscriptions, no middlemen.

This implementation appears to do exactly what it says: receive JSON webhooks, optionally validate a shared secret, format the data, and post messages via the Telegram Bot API. Before installing: (1) Only provide TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID to trusted agents/services and rotate the token if it’s ever exposed. (2) If you deploy publicly, set WEBHOOK_SECRET and ensure your endpoint is not open to the internet or is protected by firewall/ingress rules; otherwise anyone can POST to your webhook. (3) Logs print incoming payloads — treat logs as sensitive and secure log storage. (4) Run in an isolated environment (Docker recommended) and limit the bot’s permissions (use a bot with only the needed scope). (5) If you want extra assurance, review the referenced GitHub repo history and run the code locally to audit network calls during testing.

Type: OpenClaw Skill Name: signallink Version: 0.1.0 SignalLink is a legitimate utility for routing TradingView webhooks to Telegram. It uses FastAPI and httpx to handle webhooks and communicate with the Telegram API. The code includes security features like constant-time secret comparison (hmac.compare_digest) and environment variable validation. No evidence of malicious intent, data exfiltration, or prompt injection was found in files like App/webhook.py or SKILL.md. Note: The /webhook/raw endpoint in App/webhook.py lacks the authentication check found in the primary endpoint, which is a minor security oversight rather than a malicious feature.