Borrowing it
Nothing to install: this file belongs to littlebearapps/untether. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/littlebearapps/untether/master/.claude/skills/telegram-bot-api/SKILL.mdgit clone --depth 1 https://github.com/littlebearapps/untetherWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/littlebearapps/untether/telegram-bot-api)<a href="https://agentmods.dev/skills/littlebearapps/untether/telegram-bot-api"><img src="https://agentmods.dev/badge/skills/littlebearapps/untether/telegram-bot-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/littlebearapps/untether/telegram-bot-api"><img src="https://agentmods.dev/badge/skills/littlebearapps/untether/telegram-bot-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02227 |
| Opus 5.5 | $0.00028 | $0.00891 |
| Sonnet 5.5 | $0.00014 | $0.00445 |
| Haiku 4.5 | $0.00007 | $0.00223 |
Grade A, and why
telegram-bot-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Telegram Bot API (Raw HTTP)
Untether uses a custom Telegram Bot API client built on httpx (async) and msgspec (JSON). There is no Telegram SDK dependency.
Key files
| File | Purpose |
|---|---|
src/untether/telegram/client.py |
TelegramClient — Bot API facade over the outbox, per-chat pacing |
src/untether/telegram/client_api.py |
HttpBotClient — the httpx calls: 30 s message-call timeout, one safe retry (#861), benign-rejection classes (#746) |
src/untether/telegram/outbox.py |
TelegramOutbox — queued send/edit/delete with rate limiting |
src/untether/telegram/bridge.py |
TelegramPresenter — renders progress, inline keyboards, answers |
src/untether/telegram/loop.py |
Long polling loop (getUpdates), callback dispatch |
src/untether/telegram/commands/ |
Command and callback handlers |
docs/reference/transports/telegram.md |
Full transport reference |
Bot API call pattern
All calls go through TelegramClient; the HTTP layer is HttpBotClient (client_api.py), which wraps httpx.AsyncClient:
# Typical Bot API call (simplified; HttpBotClient._post)
resp = await self._http.post(
f"{self._base_url}/bot{self._token}/{method}",
json=params,
)
data = msgspec.json.decode(resp.content, type=TelegramResponse)
- Base URL:
https://api.telegram.org - Auth: bot token in the URL path (
/bot<token>/) - All responses decoded with
msgspec.json.decodeinto typed structs - Error handling: check
okfield, raise on HTTP or Telegram errors
Inline keyboards and callback queries
Permission requests and plan mode buttons use Telegram inline keyboards:
# reply_markup structure in RenderedMessage.extra
{
"reply_markup": {
"inline_keyboard": [
[{"text": "Approve", "callback_data": "claude_control:approve:<request_id>"}],
[{"text": "Deny", "callback_data": "claude_control:deny:<request_id>"}],
[{"text": "Pause & Outline Plan", "callback_data": "claude_control:discuss:<request_id>"}],
]
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +14 lines 26a4faafd35b
- 1mo ago First seen · 166 lines · 71 tokens per session scan A 632f60c0bbf0
telegram-bot-api is a skill published in the GitHub repository littlebearapps/untether (74 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 2,227 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cmux-backend
Backend TypeScript and Cloud VM development rules for cmux. Use when editing web/app/api, web/services, backend scripts, Cloud VM lifecycle, provider integrations, Postgres, Stack Auth pricing gates, migrations, or provider image build scripts.
cmux-socket-policy
Socket command threading and focus policy for cmux CLI/socket work. Use when adding or changing socket commands, CLI commands, telemetry commands, focus/select/open/close/send-key behavior, or automation that could steal app focus.
build-a-stripe-integration
Write Stripe code against what the API does today — plan the product shape, confirm every parameter from Stripe's own docs and schemas, and keep the agent in a sandbox. Use when adding checkout, billing, subscriptions, invoicing, or webhooks to a codebase, or when debugging Stripe integration code that compiles but…
laravel-expert
Laravel & PHP Development Instructions for GitHub Copilot.
auth-architect
Implement authentication and authorization with OWASP Top 10 standards, OAuth 2.0 + OIDC, WebAuthn/Passkeys, session management, and RBAC/ABAC. Use when user asks to implement login, signup, authentication, authorization, JWT, OAuth, SSO, passkeys, MFA, or role-based access. Do NOT use for API key management (use…
api-forge
Design REST/GraphQL APIs with OpenAPI 3.1, error handling, pagination, rate limiting, webhooks, and idempotency. Use when user asks to design an API, create endpoints, define REST/GraphQL schema, or generate OpenAPI spec. Do NOT use for database schema design, frontend API integration, or non-HTTP protocols (gRPC…