Telegram Group Chat Setup

Configure a MoltBot agent to participate in a Telegram group chat. Automates adding the group to the allowlist, setting mention patterns, and configuring sender permissions — all via a single gateway config patch. Use when the user wants to set up their bot in a Telegram group, enable cross-bot communication, or configure group mention gating.

This skill appears to do what it claims, but review these points before installing or running it: 1) It reads your MoltBot config (default $HOME/.clawdbot/moltbot.json or CLAWDBOT_CONFIG_PATH) to extract the Telegram bot token — ensure you trust the skill and back up your config. 2) The included script uses curl and python3 even though the skill metadata doesn't list required binaries; make sure those tools are available and run the script under an account with appropriate permissions. 3) The script invokes curl with the token in the URL (https://api.telegram.org/bot<TOKEN>/getMe) which can expose the token to other local users via the process list; consider running it in a safe environment or modifying it to use a POST with token in headers or use a socket-based API. 4) The SKILL.md relies on a 'gateway' CLI to get/patch config and restart the gateway — confirm the exact commands and behavior on your system, and review merge logic before applying patches to avoid accidental overwrites. 5) There is no upstream homepage or publisher information — if you need a higher trust level, ask the author for provenance or a signed release. If you want, I can: (a) produce a safer version of the script that avoids exposing the token on the process list, (b) draft a checklist of commands to run manually, or (c) walk through the exact config patch merge steps to safely apply changes.

Type: OpenClaw Skill Name: tg-groupchat-setup Version: 1.0.0 The skill is classified as suspicious due to its use of high-risk capabilities, including reading sensitive credentials (Telegram bot token) from the agent's configuration file (`$HOME/.clawdbot/moltbot.json`) via `scripts/detect_bot_info.sh` and making external network calls to `https://api.telegram.org`. Additionally, the `SKILL.md` explicitly instructs the AI agent to access and modify its own core configuration using `gateway action: "config.get"` and `gateway action: "config.patch"`. While these actions are plausibly aligned with the stated purpose of configuring a Telegram bot, they represent powerful capabilities that could be misused, lacking the clear benign safety of a 'benign' classification, but without explicit evidence of malicious intent like exfiltration to unauthorized endpoints.