Tgsearch Telethon

Search public Telegram channels and groups by keyword using an authorized Telethon session, returning up to 50 results as JSON.

This skill is internally consistent, but it depends on /usr/local/bin/tg_search and an already-authorized Telethon session on the VPS. Before installing or enabling it: (1) inspect the helper binary (/usr/local/bin/tg_search) to confirm its provenance and behavior; (2) verify what Telethon session files or API keys exist on the host (they will be used by the helper); (3) note the small inconsistencies (skill.json entrypoint is "tg_search" while the repository includes run.py) — ensure the platform will execute the intended wrapper; (4) run the helper in an isolated environment (or review its source) if you cannot fully trust the VPS contents. If you want higher assurance, request the helper's source or replace /usr/local/bin/tg_search with a reviewed implementation.

Type: OpenClaw Skill Name: tgsearch-telethon Version: 0.1.1 The skill executes an unprovided external binary, `/usr/local/bin/tg_search`, which is described as interacting with an 'already-authorized Telethon session'. While the `run.py` script safely passes arguments to this binary using `subprocess.run` (preventing shell injection), the functionality and security of `/usr/local/bin/tg_search` itself are opaque. This reliance on an unknown, potentially powerful, external component that accesses a sensitive session makes the skill suspicious due to the unanalyzed trust boundary, as seen in `run.py` and `SKILL.md`.