Telegram PDF Scraper

Automatically downloads and organizes PDFs from specified Telegram channels via Telegram Web, creating folders based on message headers.

This skill is not clearly malicious, but there are several inconsistencies and operational risks you should consider before installing or running it: - Documentation vs implementation mismatch: The README says use your Chrome login and that it operates on Telegram 'Document' objects, but the code launches a Playwright browser with its own profile directory ('./openclaw_chrome_profile') and relies on link/text heuristics. Expect to be prompted to log in inside the Playwright-opened window; logging into your real Chrome profile is not enough. - Persistent local profile: The skill writes a browser profile directory (cookies, session data) and downloaded files to disk. If you care about account separation, do not use a machine/profile that contains other sensitive accounts; review or sandbox that folder before reuse. - Buggy/overbroad URL filter: The code treats any href containing 'http://' or 'https://' as 'malicious' and blocks it. This is extremely broad and likely to block real Telegram downloads (or conversely allow unexpected non-http links). The heuristic could both prevent successful downloads and produce false assumptions about 'safety.' - No explicit install steps: The code depends on Playwright which normally requires installing browser binaries (e.g., running 'playwright install'). Verify how the platform will install dependencies and whether additional manual steps are required. - Audit the code before running: If you plan to run it, inspect the repo and consider running it in an isolated environment (VM or throwaway user account) so the created profile and downloads are contained. Confirm the download target directory and profile path are acceptable, and be prepared to delete './openclaw_chrome_profile' after use. If you want to proceed, consider asking the maintainer to fix the documented behavior (clarify login flow), remove the overly broad URL blocking rule, and add an explicit install guide for Playwright. If you cannot inspect or sandbox the skill, treat it as potentially unsafe for sensitive environments.

Type: OpenClaw Skill Name: telegram-pdf-scraper Version: 1.0.0 The skill automates the downloading and organization of PDF files from Telegram Web using Playwright. It includes a 'Safety Filter' in `main.py` that explicitly blocks external URLs (including all http/https links) to ensure only internal Telegram document objects are processed. The code uses a local persistent Chrome profile to maintain the user's session and implements filename sanitization to prevent filesystem errors or path traversal.