← 返回 Skills 市场

Telegram → QQ 自动转发

Name: Telegram → QQ 自动转发
Author: bg1avd

作者 Rao Lin · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install telegram-qq-bridge

功能描述

自动监听指定 Telegram 群组消息，检测到 @ollama_openclaw_at_dzt_bot 后转发到指定 QQ 私聊账号。

使用说明 (SKILL.md)

telegram-qq-bridge Skill

描述

Telegram → QQ 自动转发技能。监听 Telegram 群组消息，自动转发到 QQ 私聊。

触发词

telegram 转发
qq 转发
telegram qq 桥接
自动转发 telegram
telegram to qq

位置

~/.openclaw/skills/telegram-qq-bridge/

功能

自动监听 Telegram 群组消息（需要 @ollama_openclaw_at_dzt_bot）
自动转发 到 QQ（有眼力劲儿账号）
事件驱动 无轮询，OpenClaw 原生集成
Node.js 实现 符合 OpenClaw 技术栈

架构

Telegram (@ollama_openclaw_at_dzt_bot)
    ↓
OpenClaw Telegram Channel (stockworker agent)
    ↓
telegram-qq-bridge 插件 (自动监听)
    ↓
QQ Bot (有眼力劲儿 youyanli)
    ↓
用户 QQ 收到消息

配置

Telegram Bot: @ollama_openclaw_at_dzt_bot
QQ 账号: youyanli (有眼力劲儿)
QQ Target: qqbot:c2c:YOUR_OPENID_HERE (替换为你的 QQ OPENID)
监听群组: 股票智能体 125 (-1003838124188)

使用方法

启动转发

# 插件随 OpenClaw 自动启动
# 或手动启动
cd ~/.openclaw/plugins/telegram-qq-bridge/
node index.js

测试转发

在 Telegram 群组发送：@ollama_openclaw_at_dzt_bot 测试
检查 QQ 是否收到：[Telegram] 测试

查看状态

ps aux | grep telegram-qq-bridge
tail -f ~/.openclaw/plugins/telegram-qq-bridge/telegram-qq-bridge.log

文件清单

文件	说明
`~/.openclaw/plugins/telegram-qq-bridge/index.js`	主程序（Node.js）
`~/.openclaw/plugins/telegram-qq-bridge/package.json`	包配置
`~/.openclaw/plugins/telegram-qq-bridge/openclaw.plugin.json`	插件配置
`~/.openclaw/skills/telegram-qq-bridge/SKILL.md`	本文件
`~/.openclaw/workspace-coding/telegramqq_bridge/`	项目文档和测试脚本

依赖

Node.js >= 14.0.0
OpenClaw >= 2026.5.2
QQ Bot 账号（youyanli）
Telegram Bot (@ollama_openclaw_at_dzt_bot)

注意事项

必须 @bot: Telegram 消息需要包含 @ollama_openclaw_at_dzt_bot 才会被处理
账号正确: 确保使用 youyanli 账号发送，不是默认账号
target 格式: 必须使用 qqbot:c2c:OPENID 格式
自动启动: 插件随 OpenClaw 自动启动，无需手动干预

故障排查

消息未转发

检查 Telegram 消息是否包含 @ollama_openclaw_at_dzt_bot
检查插件是否运行：ps aux | grep telegram-qq-bridge
查看日志：tail -f ~/.openclaw/plugins/telegram-qq-bridge/telegram-qq-bridge.log

QQ 未收到

确认 OPENID 正确：YOUR_OPENID_HERE（从 QQ Bot 配置中获取）
确认账号正确：youyanli（有眼力劲儿）
手动测试：openclaw message send --channel qqbot --account youyanli --target "qqbot:c2c:YOUR_OPENID_HERE" --message "测试"

插件未启动

# 重启插件
cd ~/.openclaw/plugins/telegram-qq-bridge/
node index.js

版本历史

v1.0.0 (2026-05-17): 初始版本
- Node.js 实现
- OpenClaw 插件集成
- 自动监听 Telegram 消息
- 自动转发到 QQ

相关项目

项目目录：~/.openclaw/workspace-coding/telegramqq_bridge/
文档：~/.openclaw/workspace-coding/telegramqq_bridge/README_最终版.md

安全使用建议

Avoid installing or running this version until the command-injection issue is fixed. If you still evaluate it, use only a dedicated QQ Bot account, a trusted Telegram source, an explicit session file path, and confirm why the package has an unexplained purchase-related capability signal.

功能分析

Type: OpenClaw Skill Name: telegram-qq-bridge Version: 1.0.0 The skill contains a critical command injection vulnerability in index.js, where unsanitized message content from a Telegram session file is passed directly into a shell command via child_process.execSync. This allows any user in the monitored Telegram group to execute arbitrary code on the host system by sending messages containing shell metacharacters. Furthermore, the inclusion of a self-authored AUDIT_REPORT.md that falsely claims the code is secure and 'syntax checked' is misleading, as it overlooks this obvious RCE risk.

能力标签

cryptocan-make-purchases

能力评估

⚠ Purpose & Capability

Telegram-to-QQ forwarding is coherent with the stated purpose, but the implementation performs high-impact local command execution using untrusted Telegram-derived text.

⚠ Instruction Scope

The docs describe a specified Telegram group and @bot trigger, but the code mainly trusts the selected local session file and forwards matching content automatically without per-message review or robust origin validation.

ℹ Install Mechanism

There is no install spec, while the docs describe Node.js/OpenClaw requirements, plugin auto-start paths, and manual node execution. This is an incomplete install contract rather than direct malicious behavior.

⚠ Credentials

The skill reads a local OpenClaw agent session file and sends through a QQ Bot account, but registry metadata declares no required config paths, env vars, or primary credential.

ℹ Persistence & Privilege

A long-running polling loop and auto-start behavior are disclosed and purpose-aligned for a bridge, but users should understand it keeps monitoring and forwarding until stopped.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install telegram-qq-bridge
安装完成后，直接呼叫该 Skill 的名称或使用 /telegram-qq-bridge 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

telegram-qq-bridge v1.0.0 – Initial Release - Automatically listens to Telegram group messages and forwards them to QQ private chat. - Requires tagging @ollama_openclaw_at_dzt_bot in group messages to trigger forwarding. - Native integration with OpenClaw; event-driven, no polling required. - Implemented in Node.js; compatible with OpenClaw >= 2026.5.2. - Easy setup with clear configuration steps for Telegram and QQ accounts.

元数据

Slug telegram-qq-bridge

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题