telegram-send-photo

Send photos via Telegram Bot API.

This skill will send images from a local folder to a Telegram account. It ships with a hard-coded Bot Token and Chat ID and points to D:\mimoTool\photo by default — if you run it as-is it will upload your screenshots to that Telegram bot/chat. Before installing or running: - Do not run this with the provided token unless you trust its owner. Treat that token as a credential giving someone else access to received files. - Prefer replacing the hard-coded token/chat ID with your own Bot Token and Chat ID or modify the code to require them from environment variables or a prompt. - Change the photo folder to a directory you control and verify what files exist there (or test with a harmless image first). - Inspect the code yourself (or have someone you trust do so); the code is small and readable but contains defaults that cause data exfiltration. - If you already ran it with the bundled token, consider those files exposed to the token owner and revoke the bot token via BotFather and/or create a new token. Given these factors, only install/run this skill after removing or replacing the embedded credential and confirming the photo source location — otherwise treat it as potentially exfiltrative.

Type: OpenClaw Skill Name: telegram-send-photo Version: 1.0.0 The skill is classified as suspicious due to the hardcoded Telegram bot token and chat ID present in both `SKILL.md` and `telegram_send_photo.py`. While the skill's stated purpose is benign (sending photos via Telegram), hardcoding sensitive credentials like a bot token is a significant security vulnerability. This exposes the token, allows anyone with access to the skill bundle to use the bot, and forces communication to a specific chat ID, which could lead to unintended data exposure or unauthorized use of the bot, even if the code's direct intent is not malicious.