← 返回 Skills 市场
tmchow

Telegram Compose

作者 Trevin · GitHub ↗ · v1.0.4
darwinlinux ✓ 安全检测通过
5619
总下载
4
收藏
17
当前安装
5
版本数
在 OpenClaw 中安装
/install telegram-compose
功能描述
Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy.
安全使用建议
Install only if you want OpenClaw to send longer or structured Telegram replies through your configured Telegram bot. Keep bot accounts and chat IDs scoped to intended chats, and avoid sending secrets or private data unless you intend that content to appear in Telegram.
功能分析
Type: OpenClaw Skill Name: telegram-compose Version: 1.0.4 The skill contains a critical shell injection vulnerability in `SKILL.md`. The `$ACCOUNT` variable, which is provided by the caller, is directly interpolated into a `jq` command (`jq -r ".channels.telegram.accounts.$ACCOUNT.botToken" "$CONFIG"`) without sanitization. This allows for arbitrary command execution if a malicious string is passed as `$ACCOUNT` (e.g., `foo"; rm -rf / #`). While the skill's instructions aim for secure usage and there's no evidence of intentional malicious behavior like unauthorized data exfiltration or persistence, this RCE vulnerability makes the skill highly risky.
能力评估
Purpose & Capability
The capability is to format longer Telegram-bound content and send it through Telegram's API; credential use and outbound posting are disclosed and purpose-aligned.
Instruction Scope
Auto-invocation is scoped to substantive Telegram replies and requires caller-provided account, chat ID, optional thread ID, and content; the trigger is broad but not hidden or unrelated.
Install Mechanism
The artifact is an instruction-only SKILL.md with no executable package, installer, persistence setup, or bundled scripts.
Credentials
Reading a Telegram bot token from OpenClaw config and contacting api.telegram.org is proportionate to direct Telegram delivery, but it uses local credentials and external network transmission.
Persistence & Privilege
No background worker, self-modification, persistence, privilege escalation, destructive action, or credential harvesting beyond the specified bot token lookup is shown.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install telegram-compose
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /telegram-compose 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.4
**Summary:** This update requires callers to explicitly specify the Telegram bot account for all deliveries; auto-selection of accounts is no longer allowed. - The bot account name (e.g., "main") must now be provided by the caller for every message; the skill will not auto-select or iterate accounts. - Session/task templates and documentation updated to require explicit `Bot account: <account_name>` specification. - Credentials section and all usage examples revised to validate and use only the specified account. - Added `metadata` with OS, binary, network, and credential requirements. - Improved error handling and validation message if account is missing or invalid. - No runtime/code file changes—documentation only.
v1.0.3
**Major update:** Skill now runs as an auto-invoked sub-agent for structured Telegram message formatting and delivery. - Skill acts as a sub-agent, automatically called for substantive Telegram messages (>3 lines or with lists/sections) by the main session agent. - Clear decision rule: short/simple replies use OpenClaw message tool; structured/rich messages go through this skill. - Sub-agent receives the skill path, chat/thread IDs, and raw content, then formats and sends via Telegram API. - Expanded error handling: retries on formatting errors, splitting long messages, and fallbacks to plain text as needed. - Formatting and style rules clarified (escaping, structure, mobile display best practices). - Direct invocation and functional details are now internal; other skills do not need to call this explicitly.
v1.0.2
Expanded OpenClaw compatibility and clarified formatting best practices: - Updated references and instructions for OpenClaw config location and usage (now supports both openclaw.json and legacy clawdbot.json). - Improved credential and API call sections, including dynamic account selection and how to send to topic threads. - Clarified HTML tag usage and escaping, with more Telegram-specific context. - Expanded guidance for message layout: strict rule against using <pre> for visual layouts, with concrete good/bad mobile examples. - Updated comparison: when to use direct API vs OpenClaw message tool. - Minor terminology updates (e.g., Clawdbot → OpenClaw) for clarity.
v1.0.1
- Advises against using Markdown tables due to poor mobile readability on both desktop and mobile pclients. - Provides multiple structured message formats as alternatives, including vertical key-value, compact lists, record cards, and bullet lists. - Recommends reserving <pre> blocks for code/commands or key-value data, with bullets and bold for general structure.
v1.0.0
Initial release of telegram-compose — a skill for composing rich, structured Telegram messages via direct API with advanced HTML formatting. - Provides example commands and configuration steps for sending messages with HTML tags. - Details available HTML formatting options, including headings, expandable blockquotes, user mentions by ID, and spoilers. - Supplies clear structural and stylistic guidelines for professional, scannable messaging. - Outlines use cases, message limits, and decision criteria for when to use direct API over Clawdbot’s Markdown conversion. - Includes practical message templates for alerts, status updates, and lists.
元数据
Slug telegram-compose
版本 1.0.4
许可证
累计安装 212
当前安装数 17
历史版本数 5
常见问题

Telegram Compose 是什么?

Format and deliver rich Telegram messages with HTML formatting via direct Telegram API. Auto-invoked by the main session for substantive Telegram output — no other skills need to call it. Decision rule: If your Telegram reply is >3 lines or contains structured data (lists, stats, sections, reports), spawn this as a Haiku sub-agent to format and send. Short replies (<3 lines) go directly via OpenClaw message tool. Handles: research summaries, alerts, status updates, reports, briefings, notifications — anything with visual hierarchy. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 5619 次。

如何安装 Telegram Compose?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install telegram-compose」即可一键安装,无需额外配置。

Telegram Compose 是免费的吗?

是的,Telegram Compose 完全免费(开源免费),可自由下载、安装和使用。

Telegram Compose 支持哪些平台?

Telegram Compose 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(darwin, linux)。

谁开发了 Telegram Compose?

由 Trevin(@tmchow)开发并维护,当前版本 v1.0.4。

💬 留言讨论