← Back to Skills Marketplace
tmchow

Telegram Compose

by Trevin · GitHub ↗ · v1.0.4
darwinlinux ⚠ suspicious
6545
Downloads
4
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install telegram-compose
Description
Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy.
Usage Guidance
Install only if you are comfortable with this skill automatically sending Telegram-targeted substantive messages through a bot token stored in OpenClaw config. Keep the bot limited to intended chats, avoid sending secrets or sensitive reports through it, and treat invalid topic fallback and command-line token exposure as issues to fix before high-sensitivity use.
Capability Analysis
Type: OpenClaw Skill Name: telegram-compose Version: 1.0.4 The skill contains a critical shell injection vulnerability in `SKILL.md`. The `$ACCOUNT` variable, which is provided by the caller, is directly interpolated into a `jq` command (`jq -r ".channels.telegram.accounts.$ACCOUNT.botToken" "$CONFIG"`) without sanitization. This allows for arbitrary command execution if a malicious string is passed as `$ACCOUNT` (e.g., `foo"; rm -rf / #`). While the skill's instructions aim for secure usage and there's no evidence of intentional malicious behavior like unauthorized data exfiltration or persistence, this RCE vulnerability makes the skill highly risky.
Capability Assessment
⚠ Credentials
Reading the OpenClaw bot token and sending to Telegram are purpose-aligned, but the direct curl pattern places the bot token in the command-line URL and destinations are task-provided without documented allowlisting.
✓ Install Mechanism
The artifact is a Markdown skill with no installer, package downloads, background services, or bundled executable files; it declares jq, curl, OpenClaw config, exec, Read, and Telegram network use.
⚠ Instruction Scope
The auto-invocation rule is broad for substantive Telegram output, and the skill does not document sensitivity checks or explicit confirmation before sending externally; it also retries invalid topic sends into the General topic.
✓ Persistence & Privilege
No persistence, privilege escalation, tool hijacking, memory writes, or cross-session modification behavior was found.
ℹ Purpose & Capability
The stated purpose matches the capability: format rich Telegram messages and send them to api.telegram.org using a caller-specified bot account, chat ID, and optional thread ID.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install telegram-compose
  3. After installation, invoke the skill by name or use /telegram-compose
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
**Summary:** This update requires callers to explicitly specify the Telegram bot account for all deliveries; auto-selection of accounts is no longer allowed. - The bot account name (e.g., "main") must now be provided by the caller for every message; the skill will not auto-select or iterate accounts. - Session/task templates and documentation updated to require explicit `Bot account: <account_name>` specification. - Credentials section and all usage examples revised to validate and use only the specified account. - Added `metadata` with OS, binary, network, and credential requirements. - Improved error handling and validation message if account is missing or invalid. - No runtime/code file changes—documentation only.
v1.0.3
**Major update:** Skill now runs as an auto-invoked sub-agent for structured Telegram message formatting and delivery. - Skill acts as a sub-agent, automatically called for substantive Telegram messages (>3 lines or with lists/sections) by the main session agent. - Clear decision rule: short/simple replies use OpenClaw message tool; structured/rich messages go through this skill. - Sub-agent receives the skill path, chat/thread IDs, and raw content, then formats and sends via Telegram API. - Expanded error handling: retries on formatting errors, splitting long messages, and fallbacks to plain text as needed. - Formatting and style rules clarified (escaping, structure, mobile display best practices). - Direct invocation and functional details are now internal; other skills do not need to call this explicitly.
v1.0.2
Expanded OpenClaw compatibility and clarified formatting best practices: - Updated references and instructions for OpenClaw config location and usage (now supports both openclaw.json and legacy clawdbot.json). - Improved credential and API call sections, including dynamic account selection and how to send to topic threads. - Clarified HTML tag usage and escaping, with more Telegram-specific context. - Expanded guidance for message layout: strict rule against using <pre> for visual layouts, with concrete good/bad mobile examples. - Updated comparison: when to use direct API vs OpenClaw message tool. - Minor terminology updates (e.g., Clawdbot → OpenClaw) for clarity.
v1.0.1
- Advises against using Markdown tables due to poor mobile readability on both desktop and mobile pclients. - Provides multiple structured message formats as alternatives, including vertical key-value, compact lists, record cards, and bullet lists. - Recommends reserving <pre> blocks for code/commands or key-value data, with bullets and bold for general structure.
v1.0.0
Initial release of telegram-compose — a skill for composing rich, structured Telegram messages via direct API with advanced HTML formatting. - Provides example commands and configuration steps for sending messages with HTML tags. - Details available HTML formatting options, including headings, expandable blockquotes, user mentions by ID, and spoilers. - Supplies clear structural and stylistic guidelines for professional, scannable messaging. - Outlines use cases, message limits, and decision criteria for when to use direct API over Clawdbot’s Markdown conversion. - Includes practical message templates for alerts, status updates, and lists.
Metadata
Slug telegram-compose
Version 1.0.4
License —
All-time Installs 0
Active Installs 0
Total Versions 5
Frequently Asked Questions

What is Telegram Compose?

Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy. It is an AI Agent Skill for Claude Code / OpenClaw, with 6545 downloads so far.

How do I install Telegram Compose?

Run "/install telegram-compose" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Telegram Compose free?

Yes, Telegram Compose is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Telegram Compose support?

Telegram Compose is cross-platform and runs anywhere OpenClaw / Claude Code is available (darwin, linux).

Who created Telegram Compose?

It is built and maintained by Trevin (@tmchow); the current version is v1.0.4.

💬 Comments