Tgcli

Name: Tgcli
Author: kfastov

Listed

kfastov·v2.0.8·other·MIT

Telegram CLI for reading/searching messages, syncing archives, and sending or downloading files. Use when the user asks about Telegram chats, messages, contacts, groups, or files.

Repository

Install on your platform

Showing OpenClaw.

1
Run this in your terminal
terminal
```
$ openclaw skills install tgcli
```

What we know about this skill

Publisher

kfastov

Taken from the source listing. We haven't verified who controls this account.

Install target

Pinned to 493a3e7f

Installs fetch a stored snapshot of that commit, so the code can't change after the fact.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned 5 Oct 2026

This skill failed 2 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

No undeclared network calls: failed
Contacts 8 hosts that are neither well-known infrastructure nor declared in the skill's frontmatter: astral.sh, deb.nodesource.com, feross.org, opencollective.com, t.me….
Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.
Hosts contacted
registry.npmjs.orgpackage registrydeb.nodesource.comundeclaredastral.shundeclaredgithub.comsource hostwww.apple.comundeclaredt.meundeclared127.0.0.1localopencollective.comundeclaredwww.patreon.comundeclaredfeross.orgundeclaredtidelift.comundeclared
What it found (3 of 50)
- Dockerfile:7contacts deb.nodesource.com
  RUN (groupadd -r service-user) && (useradd -u 1987 -r -m -g service-user service-user) && (mkdir -p /home/service-user/.local/bin /app) && (chown -R service-us…
- Dockerfile:7contacts astral.sh
  RUN (groupadd -r service-user) && (useradd -u 1987 -r -m -g service-user service-user) && (mkdir -p /home/service-user/.local/bin /app) && (chown -R service-us…
- cli.js:997contacts www.apple.com
  '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',

No pipe-to-shell installers: failed

Runs code fetched at install time in 2 places.

No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

What it found

Dockerfile:7remote script piped into a shell

RUN (groupadd -r service-user) && (useradd -u 1987 -r -m -g service-user service-user) && (mkdir -p /home/service-user/.local/bin /app) && (chown -R service-us…

Dockerfile:7npm install straight from a URL

RUN (groupadd -r service-user) && (useradd -u 1987 -r -m -g service-user service-user) && (mkdir -p /home/service-user/.local/bin /app) && (chown -R service-us…

Declares what it does: passed
SKILL.md parses and declares a name and a description.
SKILL.md exists, its frontmatter parses, and it declares a name and a description.
No obfuscated payloads: passed
No encoded or obfuscated payloads.
No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.
No credential access: passed
Reads no keys, tokens, keychains or credential files.
Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.
Pinned to a commit: passed
Scanned kfastov/tgcli at 1df3e67999.
The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit: 1df3e67999
Manifest: SKILL.md
Scanned: 60 files, 23,940 lines

This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.

What each check looks for →

About this skill

What it does

tgcli is a command-line interface for interacting with Telegram using your personal account (MTProto protocol), not the bot API. It allows you to synchronize messages, search through conversations, send text and files, and optionally run a background sync service (MCP) for persistent connectivity. The tool supports archiving backfill and real-time message synchronization.

When to use it

Archiving Telegram Conversations: Retrieve and store old messages from specific channels or chats for backup or analysis.
Searching for Specific Content: Quickly find messages containing certain keywords within a channel or conversation archive.
Sending Messages Programmatically: Automate sending text messages to contacts or channels, useful for notifications or reminders.
Managing Telegram Data Offline: Access and manage your Telegram data even with intermittent internet connectivity by utilizing the optional MCP server.

Key capabilities

Authentication using api_id and api_hash credentials from my.telegram.org.
Message synchronization (backfill and real-time).
Searching messages within chats and channels.
Sending text messages to contacts or channels.
Downloading media files.
Optional MCP server for persistent background sync.
Configuration options via tgcli config.

Example prompts

tgcli messages list --chat @username --limit 10: Lists the last 10 messages from a specific chat.
tgcli send text --to @username --message "Hello, this is automated!": Sends a message to a contact.
tgcli sync --follow --chat @channel: Synchronizes messages for a specified channel and continues syncing in real-time.

Tips & gotchas

You'll need to obtain your api_id and api_hash from my.telegram.org/apps before using the tool.
The configuration store is located in your OS app-data directory; use the TGCLI_STORE environment variable to override its location if needed.