← Back to Skills Marketplace
tmchow

Telegram Compose

by Trevin · GitHub ↗ · v1.0.4
darwinlinux ✓ Security Clean
5619
Downloads
4
Stars
17
Active Installs
5
Versions
Install in OpenClaw
/install telegram-compose
Description
Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy.
Usage Guidance
Install only if you want OpenClaw to send longer or structured Telegram replies through your configured Telegram bot. Keep bot accounts and chat IDs scoped to intended chats, and avoid sending secrets or private data unless you intend that content to appear in Telegram.
Capability Analysis
Type: OpenClaw Skill Name: telegram-compose Version: 1.0.4 The skill contains a critical shell injection vulnerability in `SKILL.md`. The `$ACCOUNT` variable, which is provided by the caller, is directly interpolated into a `jq` command (`jq -r ".channels.telegram.accounts.$ACCOUNT.botToken" "$CONFIG"`) without sanitization. This allows for arbitrary command execution if a malicious string is passed as `$ACCOUNT` (e.g., `foo"; rm -rf / #`). While the skill's instructions aim for secure usage and there's no evidence of intentional malicious behavior like unauthorized data exfiltration or persistence, this RCE vulnerability makes the skill highly risky.
Capability Assessment
Purpose & Capability
The capability is to format longer Telegram-bound content and send it through Telegram's API; credential use and outbound posting are disclosed and purpose-aligned.
Instruction Scope
Auto-invocation is scoped to substantive Telegram replies and requires caller-provided account, chat ID, optional thread ID, and content; the trigger is broad but not hidden or unrelated.
Install Mechanism
The artifact is an instruction-only SKILL.md with no executable package, installer, persistence setup, or bundled scripts.
Credentials
Reading a Telegram bot token from OpenClaw config and contacting api.telegram.org is proportionate to direct Telegram delivery, but it uses local credentials and external network transmission.
Persistence & Privilege
No background worker, self-modification, persistence, privilege escalation, destructive action, or credential harvesting beyond the specified bot token lookup is shown.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install telegram-compose
  3. After installation, invoke the skill by name or use /telegram-compose
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
**Summary:** This update requires callers to explicitly specify the Telegram bot account for all deliveries; auto-selection of accounts is no longer allowed. - The bot account name (e.g., "main") must now be provided by the caller for every message; the skill will not auto-select or iterate accounts. - Session/task templates and documentation updated to require explicit `Bot account: <account_name>` specification. - Credentials section and all usage examples revised to validate and use only the specified account. - Added `metadata` with OS, binary, network, and credential requirements. - Improved error handling and validation message if account is missing or invalid. - No runtime/code file changes—documentation only.
v1.0.3
**Major update:** Skill now runs as an auto-invoked sub-agent for structured Telegram message formatting and delivery. - Skill acts as a sub-agent, automatically called for substantive Telegram messages (>3 lines or with lists/sections) by the main session agent. - Clear decision rule: short/simple replies use OpenClaw message tool; structured/rich messages go through this skill. - Sub-agent receives the skill path, chat/thread IDs, and raw content, then formats and sends via Telegram API. - Expanded error handling: retries on formatting errors, splitting long messages, and fallbacks to plain text as needed. - Formatting and style rules clarified (escaping, structure, mobile display best practices). - Direct invocation and functional details are now internal; other skills do not need to call this explicitly.
v1.0.2
Expanded OpenClaw compatibility and clarified formatting best practices: - Updated references and instructions for OpenClaw config location and usage (now supports both openclaw.json and legacy clawdbot.json). - Improved credential and API call sections, including dynamic account selection and how to send to topic threads. - Clarified HTML tag usage and escaping, with more Telegram-specific context. - Expanded guidance for message layout: strict rule against using <pre> for visual layouts, with concrete good/bad mobile examples. - Updated comparison: when to use direct API vs OpenClaw message tool. - Minor terminology updates (e.g., Clawdbot → OpenClaw) for clarity.
v1.0.1
- Advises against using Markdown tables due to poor mobile readability on both desktop and mobile pclients. - Provides multiple structured message formats as alternatives, including vertical key-value, compact lists, record cards, and bullet lists. - Recommends reserving <pre> blocks for code/commands or key-value data, with bullets and bold for general structure.
v1.0.0
Initial release of telegram-compose — a skill for composing rich, structured Telegram messages via direct API with advanced HTML formatting. - Provides example commands and configuration steps for sending messages with HTML tags. - Details available HTML formatting options, including headings, expandable blockquotes, user mentions by ID, and spoilers. - Supplies clear structural and stylistic guidelines for professional, scannable messaging. - Outlines use cases, message limits, and decision criteria for when to use direct API over Clawdbot’s Markdown conversion. - Includes practical message templates for alerts, status updates, and lists.
Metadata
Slug telegram-compose
Version 1.0.4
License
All-time Installs 212
Active Installs 17
Total Versions 5
Frequently Asked Questions

What is Telegram Compose?

Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy. It is an AI Agent Skill for Claude Code / OpenClaw, with 5619 downloads so far.

How do I install Telegram Compose?

Run "/install telegram-compose" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Telegram Compose free?

Yes, Telegram Compose is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Telegram Compose support?

Telegram Compose is cross-platform and runs anywhere OpenClaw / Claude Code is available (darwin, linux).

Who created Telegram Compose?

It is built and maintained by Trevin (@tmchow); the current version is v1.0.4.

💬 Comments