Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add serejaris/personal-corp-os --skill tg-bot-opsgit clone --depth 1 https://github.com/serejaris/personal-corp-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/serejaris/personal-corp-os/tg-bot-ops)<a href="https://agentmods.dev/skills/serejaris/personal-corp-os/tg-bot-ops"><img src="https://agentmods.dev/badge/skills/serejaris/personal-corp-os/tg-bot-ops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/serejaris/personal-corp-os/tg-bot-ops"><img src="https://agentmods.dev/badge/skills/serejaris/personal-corp-os/tg-bot-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 84 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.01476 |
| Opus 5 | $0.00073 | $0.00738 |
| Sonnet 5 | $0.00029 | $0.00295 |
| Haiku 4.5 | $0.00015 | $0.00148 |
Grade A, and why
tg-bot-ops scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
import json, os, urllib.request How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Telegram Bot Ops
Use this skill when the real question is whether a Telegram bot is receiving updates, processing them in the intended runtime, and sending visible responses to the right chat, user, or forum topic.
Public Safety
- Default to read-only diagnostics.
- Do not print tokens,
.envvalues, connection strings, raw logs, private DMs, payment payloads, session files, or full user records. - Use placeholders in notes and examples:
<TELEGRAM_BOT_TOKEN>,<TELEGRAM_USER_ID>,<CHAT_ID>,<TOPIC_ID>,<WEBHOOK_URL>. - Do not send Telegram messages, restart production services, change webhooks, edit BotFather settings, or deploy until the user has authorized that exact action.
- If any real secret appears in the repo, logs, or prompt, stop and tell the user it must be rotated before public release.
Intake
If the repo or runtime is unclear, identify:
- bot repo and language/runtime;
- deployment target: local, Docker, VPS/systemd, Railway, Render, Fly, Vercel, or other;
- update mode: webhook, polling, or unknown;
- env source for
TELEGRAM_BOT_TOKEN; - expected symptom, chat surface, and timestamp;
- whether production restart/deploy is allowed.
Diagnostic Flow
- Repo and runtime — inspect entrypoints, process manager, deploy files, and current git state.
- Environment — verify required env var names exist without printing values.
- Update intake — classify runtime: HTTP Bot API webhook, HTTP Bot API polling, MTProto bot session, or MTProto user session.
- Bot API identity — for Bot API-token runtimes, run
getMeusing a masked token path. - Webhook/polling mode — for Bot API-token runtimes, run
getWebhookInfoand inspect runtime logs. - Single update owner — resolve
409 Conflictby reading the error text: webhook conflict means webhook/deleteWebhook path; competinggetUpdatesmeans find the polling owner. - Telegram delivery — use a fresh nonce for Bot API or Telethon/user-session E2E when user-visible behavior matters.
- Handler/runtime — prove the runtime received and processed the update.
- Outbound response — prove the bot sent to the expected chat/topic.
- Incident note — report symptom, evidence, root cause, fix, and residual risk.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 136 lines · 146 tokens per session scan A e47447c50b64
tg-bot-ops is a skill published in the GitHub repository serejaris/personal-corp-os (225 stars, last pushed 16d ago), licensed MIT. It adds 146 tokens to every session and 1,476 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-docs-generator
Audits and enhances FastAPI and REST API documentation: missing descriptions, response codes, examples, docstrings, Pydantic models, OpenAPI spec. Triggers on: "generate API docs", "document this API", "OpenAPI for", "FastAPI docs", "document endpoints", "swagger docs".
telnyx-api
Use this skill when working with Telnyx communication APIs for SMS/MMS messaging, voice calls, phone number management, messaging profiles, webhook integration, two-way SMS conversations, bulk sending, message scheduling, or production deployment of telephony features. v2.0 includes official Telnyx documentation…
supabase-skill
Configure and manage Supabase projects using MCP (Model Context Protocol). Use this skill when working with Supabase databases, setting up MCP servers, designing database schemas, implementing Row Level Security, managing migrations, or building modern data architectures with PostgreSQL. Essential for Supabase…
twilio-api
Use this skill when working with Twilio communication APIs for SMS/MMS messaging, voice calls, phone number management, TwiML, webhook integration, two-way SMS conversations, bulk sending, or production deployment of telephony features. Includes official Twilio patterns, production code examples from Twilio-Aldea…
netlify-integration
Deploy and manage Netlify projects using Next.js with serverless functions, environment variables, and continuous deployment. Use this skill when working with Netlify deployments, configuring netlify.toml, managing Netlify Functions, debugging webhooks, setting environment variables, or troubleshooting deployment…
sms
Send, read, listen, respond, and manage SMS conversations via Telnyx and Twilio. Supports 8 phone numbers across both providers with auto-detection, conversation threading, MMS, real-time inbound listening, background watcher, batch reply processor, and soul-aware auto-reply. 10 Python scripts for SMS operations.