Telegram Cloud Storage

A high-performance Telegram Cloud Storage solution using Teldrive. Turns Telegram into an unlimited cloud drive with a local API/UI.

This package appears to be a straightforward wrapper around Teldrive, but review these before installing: (1) Trust the binary source — the installer downloads a GitHub release; confirm the release and checksum if you need assurance. (2) Expect to provide Telegram App ID/Hash, a Postgres connection string, and a JWT secret — those are required for operation. (3) The Python client reads TELDRIVE_TOKEN and TELDRIVE_SESSION_HASH from env or token files; the registry metadata doesn't declare these env vars, so be aware of where tokens/sessions will be stored (config/token.txt and the DB). (4) setup.sh is interactive and uses simple sed substitutions that may break or mangle inputs containing special characters — avoid pasting complex secrets with newlines or problematic characters, or edit config/config.toml by hand. (5) Check how the server binds (network exposure) and ensure you do not expose the service publicly without authentication and a strong JWT secret. (6) If you have low trust in the publisher, run the skill in an isolated environment (container/VM) and inspect the downloaded teldrive release before running.

Type: OpenClaw Skill Name: telegram-cloud-storage Version: 1.8.2 The skill is classified as suspicious primarily due to `scripts/install_binary.sh` which downloads and executes a remote binary from GitHub. While the source (`https://github.com/tgdrive/teldrive`) appears official for the stated purpose, downloading and executing code from an external source is a high-risk operation that could be exploited in a supply chain attack if the remote repository were compromised. Additionally, the skill handles sensitive credentials like Telegram API keys, database connection strings, and JWT secrets, which, while necessary for its functionality, represent a significant attack surface if the skill itself were compromised.