DC Telegram Bot API

Build Telegram bots with correct API calls, message formatting, keyboards, and webhook setup.

Not recommendedlow grade D

ClawHub Agent Skills author: Iván v1.0.0 10 files body ≈ 1 182 tokens Open the sourceclawhub.ai↗ analyzed 2 d ago

As a process C 58/100 · Has gaps — weak spots: result and completion, when it triggers, inputs and preconditions

Integration Telegram Infrastructuretype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

58/100

safety, quality, tests

Safety 60%: 48
Quality 40%: 74
Run on models: none yet

Process rating

58/100

Has gaps

Result and completion w 14: 0
Inputs and preconditions w 11: 0
When it triggers w 12: 20

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

How to improve

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 44

✓ No critical or high findings

Medium and low: 44

medium Exfiltration exfil-webhook-url SKILL.md:48

Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host)
```
https://api.telegram.org/bot{TOKEN}/{METHOD}
```
vendor-host
medium Exfiltration exfil-webhook-url SKILL.md:131

Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host)
```
| https://api.telegram.org/bot{TOKEN}/* | Messages, media, commands | All bot operations |
```
vendor-host
low Exfiltration exfil-webhook-url errors.md:88

Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)
```
url = f"https://api.telegram.org/bot{TOKEN}/sendMessage"
```
vendor-hostquoted
low Exfiltration exfil-webhook-url errors.md:155

Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)
```
f"https://api.telegram.org/bot{TOKEN}/{method}",
```
vendor-hostquoted
low Exfiltration exfil-webhook-url keyboards.md:19

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
placeholder
low Exfiltration net-credential-use keyboards.md:19

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
vendor-host
low Exfiltration exfil-webhook-url keyboards.md:85

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/answerCallbackQuery" \
```
placeholder
low Exfiltration net-credential-use keyboards.md:85

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/answerCallbackQuery" \
```
vendor-host
low Exfiltration exfil-webhook-url keyboards.md:93

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/editMessageText" \
```
placeholder
low Exfiltration net-credential-use keyboards.md:93

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/editMessageText" \
```
vendor-host
low Exfiltration exfil-webhook-url keyboards.md:114

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
placeholder
low Exfiltration net-credential-use keyboards.md:114

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
vendor-host
low Exfiltration exfil-webhook-url keyboards.md:162

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
placeholder
low Exfiltration net-credential-use keyboards.md:162

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
vendor-host
low Exfiltration exfil-webhook-url media.md:25

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
placeholder
low Exfiltration net-credential-use media.md:25

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
vendor-host
low Exfiltration exfil-webhook-url media.md:34

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
placeholder
low Exfiltration net-credential-use media.md:34

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
vendor-host
low Exfiltration exfil-webhook-url media.md:48

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
placeholder
low Exfiltration net-credential-use media.md:48

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
vendor-host
low Exfiltration exfil-webhook-url media.md:86

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl "https://api.telegram.org/bot${TOKEN}/getFile?file_id=…"
```
placeholder
low Exfiltration net-credential-use media.md:86

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl "https://api.telegram.org/bot${TOKEN}/getFile?file_id=…"
```
vendor-host
low Exfiltration net-credential-use media.md:105

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -O "https://api.telegram.org/file/bot${TOKEN}/photos/file_0.jpg"
```
vendor-host
low Exfiltration exfil-webhook-url media.md:118

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendPhoto" \
```
placeholder
low Exfiltration exfil-webhook-url methods.md:9

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=…&timeout=30"
```
placeholder
low Exfiltration net-credential-use methods.md:9

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=…&timeout=30"
```
vendor-host
low Exfiltration exfil-webhook-url methods.md:25

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
placeholder
low Exfiltration net-credential-use methods.md:25

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
vendor-host
low Exfiltration exfil-webhook-url methods.md:44

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/deleteWebhook?drop_pending_updates=true"
```
placeholder
low Exfiltration net-credential-use methods.md:44

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/deleteWebhook?drop_pending_updates=true"
```
vendor-host
low Exfiltration exfil-webhook-url methods.md:51

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl "https://api.telegram.org/bot${TOKEN}/getWebhookInfo"
```
placeholder
low Exfiltration net-credential-use methods.md:51

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl "https://api.telegram.org/bot${TOKEN}/getWebhookInfo"
```
vendor-host
low Exfiltration exfil-webhook-url methods.md:62

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
placeholder
low Exfiltration net-credential-use methods.md:62

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/sendMessage" \
```
vendor-host
low Exfiltration exfil-webhook-url webhooks.md:26

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
response=$(curl -s "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=…&timeout=30")
```
placeholder
low Exfiltration net-credential-use webhooks.md:26

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
response=$(curl -s "https://api.telegram.org/bot${TOKEN}/getUpdates?offset=…&timeout=30")
```
vendor-host
low Exfiltration exfil-webhook-url webhooks.md:47

Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)
```
BASE_URL = f"https://api.telegram.org/bot{TOKEN}"
```
vendor-hostquoted
low Exfiltration exfil-webhook-url webhooks.md:81

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl "https://api.telegram.org/bot${TOKEN}/getUpdates" \
```
placeholder
low Exfiltration net-credential-use webhooks.md:81

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl "https://api.telegram.org/bot${TOKEN}/getUpdates" \
```
vendor-host
low Exfiltration exfil-webhook-url webhooks.md:114

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
placeholder
low Exfiltration net-credential-use webhooks.md:114

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
vendor-host
low Exfiltration exfil-webhook-url webhooks.md:131

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
placeholder
low Exfiltration net-credential-use webhooks.md:131

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
vendor-host
low Exfiltration net-credential-use webhooks.md:139

Credential used in a network call (verify the destination is the intended service) (the skill's own vendor host)
```
curl -X POST "https://api.telegram.org/bot${TOKEN}/setWebhook" \
```
vendor-host

Files scanned: 10. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning name-format name should be kebab-case (lowercase letters, digits, hyphens)
note frontmatter-key unknown frontmatter key "slug"
note frontmatter-key unknown frontmatter key "homepage"

Process rating: all ten parameters 58/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
20When it triggers. No condition that starts the skill
30Running it twice. 9 mutating operations with no state check
40Consistency. Frontmatter name (Telegram Bot API) differs from the folder (telegram-bot-api)
100Tools and files. No external tools needed
100Steps. 26 steps
100Failures and branches. 1 branches, has a failure section
100Execution cost. Instruction body is 1182 tokens
100Progress reporting. Reports progress

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 11 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Description length 93: 120–800 characters recommended
+3Output format is not stated: the model decides each time
+1No license
+2Single-language instructions
+4Structure: 18 headings
+3Step-by-step instructions: 26 items
+4Has examples (2 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 74.

External checks

ClawHub: clean

This is a coherent Telegram Bot API reference skill, but users should treat bot tokens and bot-sent data as sensitive.

LLM: benign (high) · VirusTotal: benign · 28 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 10

errors.md 6K
formatting.md 4K
keyboards.md 6K
media.md 6K
memory-template.md 1K
methods.md 8K
setup.md 2K
skill-card.md 2K
SKILL.md 5K
webhooks.md 6K

When to use

User needs to interact with the Telegram Bot API. Building bots, sending messages, handling updates, setting up webhooks, creating keyboards, or managing bot commands.

Frontmatter

slug: telegram-bot-api

version: 1.0.0

homepage: https://clawic.com/skills/telegram-bot-api

metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["curl"]},"os":["linux","darwin","win32"]}}

Dates

In catalog since 24 Feb 2026

Updated in catalog 11 May 2026

First seen here 10 Sept 2026

Last analysis 11 Sept 2026, 02:43 UTC

Last seen in crawl 8 h ago

Score history

Date		Score	Safety	Qual.
11 Sept 2026	D	58	48	74
10 Sept 2026	D	57	48	71

Similar skills

D Telegram Bot API modbender/skill-library-mcp