Telegram MCP: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, obfuscated code, privilege escalation behavior, or undisclosed data transfer outside the Telegram functionality the skill describes. The repository also documents prompt-injection risk from Telegram content and gives guidance for sanitizing untrusted message fields.

The main concern is operational scope. Based on the reviewed materials, the server can do more than read Telegram data: it can send and modify messages and manage groups. The README describes broad default tool exposure, while read-only operation appears to be an optional restriction rather than the default. We also did not see a built-in confirm-before-send safeguard described for write actions. That combination can increase the chance of unintended changes if the skill is connected with wider permissions than the user expects.

What to do instead

Use this skill only if you need Telegram write actions. Prefer a read-only configuration when possible, connect only the specific account you intend to use, and limit which tools are exposed to the model. Keep human approval in the loop for sending, editing, or group-management actions, and follow the repo guidance for protecting environment variables, session strings, and `.session` files.