TMS (Telegram Media Server)

Manage downloads via Telegram Media Server (TMS) REST API — add by URL (video/magnet/torrent URL) or torrent_base64 (.torrent bytes), list, delete, search to...

This skill is coherent and appears to only instruct the agent to talk to a TMS API. Before installing: (1) ensure the TMS instance you point to (TMS_API_URL) is one you control and trust; (2) when the agent is not colocated with TMS, set a dedicated TMS_API_KEY and store it per-skill (do not reuse broad keys); (3) be aware the default BaseURL uses localhost — the agent will be able to reach local services when enabled, so restrict the skill or disable autonomous invocation if you don't want the agent to start/stop downloads without explicit prompts; (4) if you accept torrent files via uploads, be careful what files are placed in the agent workspace (the skill supports sending torrent_base64 derived from workspace files); (5) secure any webhook endpoints and rotate keys if exposed. If you want extra caution, disable model autonomous invocation for this skill or require explicit user confirmation before performing add/delete operations.

Type: OpenClaw Skill Name: tms Version: 1.0.7 The skill is a well-documented instruction set and OpenAPI specification for an AI agent to interact with the Telegram Media Server (TMS) REST API. It enables standard media management functions such as adding downloads via URL or Base64-encoded torrent files, listing active tasks, and searching torrents. There is no evidence of malicious code, data exfiltration, or prompt injection; the skill operates purely via HTTP requests to a user-configured endpoint (TMS_API_URL) and includes appropriate security warnings regarding API key management and trusted hosts.