$ loading_
Reproduce and record real Telegram interactions on Crabbox for behavior proof.
The material shows a skill that drives a real Telegram user session in Crabbox to produce visual proof, involving shared credential leasing, remote component download, WebVNC observation, and local artifact writes. Although it is open source with very strong community signals, its capabilities go beyond prompt-only behavior and include real account actions and external service interaction, so the overall posture is caution rather than high risk.
The listing says there are no local keys to provide, but the README explicitly states it leases a shared `telegram-user` credential from Convex and restores the same real Telegram user session. This means the skill indirectly uses sensitive account credentials; while it warns not to place secrets in the repo/prompt/artifacts, a shared burner account still carries session misuse and unintended action risks.
The system metadata says there are no remote endpoints, but the README explicitly references downloading `http://artifacts.openclaw.ai/tdlib-v1.8.0-linux-x64.tgz` and implies external communication for Convex credential leasing, the Telegram session itself, and WebVNC observation. This creates a normal data-egress surface for test content, chat data, and recording-related traffic to declared services, but there is no clear red flag of exfiltration to unrelated or unknown endpoints.
The README instructs running `openclaw-telegram-user-crabbox-proof`, which starts Telegram Desktop, TDLib, a mock SUT, desktop recording, and allows the agent to run several commands and use WebVNC while the session remains alive. This indicates local/container process execution and automation capabilities; that is a standard high-privilege surface for this class of tool, and the material does not show a clear request for system privileges beyond its stated purpose.
The material shows it runs from the current OpenClaw checkout/branch, reads a local mock-response file, writes `.artifacts/.../session.json` and recording artifacts, and can inspect transcripts. Its data-access scope therefore includes the workspace, artifact directories, and Telegram session content; this is typical for an E2E reproduction tool, but it should be treated as capable of touching sensitive chat and visual evidence data.
Positive evidence includes a GitHub open-source repository, auditability, and extremely strong community adoption (377k+ stars), all of which materially lower risk. Points to watch are the missing license declaration, unknown maintenance status, and the README's remote TDLib archive download; without integrity verification, there is a normal dependency/artifact integrity risk, but the available facts do not justify a high-risk rating.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "telegram-crabbox-e2e-proof" skill from askskill: 1. Download https://raw.githubusercontent.com/openclaw/openclaw/main/.agents/skills/telegram-crabbox-e2e-proof/SKILL.md 2. Save it as ~/.claude/skills/telegram-crabbox-e2e-proof/SKILL.md 3. Reload skills and tell me it's ready
In Crabbox, use a real Telegram user session to reproduce OpenClaw message sending, receiving, and UI changes in the specified chat. Use TDLib user-driver commands, enable WebVNC observation, and export motion-trimmed video evidence plus a key-step log.
A reviewable reproduction package with action logs, recording evidence, key screenshots, and findings.
For this PR’s Telegram behavior changes, use an agent-controlled Telegram Desktop in Crabbox to run an end-to-end verification. Record the full workflow, compare expected versus actual results, and produce evidence suitable for code review.
A PR-focused verification report with steps, result comparisons, recording clips, and a conclusion.
Use Convex-leased Telegram credentials in Crabbox to complete login and session validation, verify that user-driver commands work correctly, confirm the UI is observable, and report any issues with supporting evidence.
A validation result for the login and credential flow, including session status, issue list, and supporting evidence.
Use this for Telegram PR review or bug reproduction when bot-to-bot proof is not enough. The goal is to let the agent keep a real Telegram user session open until it is satisfied, then attach visual proof.
Do not use personal accounts. Do not add credentials to the repo, prompt, or artifact bundle. The runner leases the shared burner account from Convex.
Run from the OpenClaw repo and branch under test:
proof_cmd="${OPENCLAW_TELEGRAM_USER_PROOF_CMD:-openclaw-telegram-user-crabbox-proof}"
"$proof_cmd" start \
--tdlib-url http://artifacts.openclaw.ai/tdlib-v1.8.0-linux-x64.tgz \
--output-dir .artifacts/qa-e2e/telegram-user-crabbox/pr-review
This starts one held session:
telegram-user Convex credential.artifacts/qa-e2e/telegram-user-crabbox/pr-review/session.jsonKeep the session alive while investigating. It is valid for the agent to test for minutes, run several commands, use WebVNC, inspect transcripts, and only finish once the behavior is understood.
For deterministic visual repros, put the exact mock-model reply in a file and
pass it to start:
proof_cmd="${OPENCLAW_TELEGRAM_USER_PROOF_CMD:-openclaw-telegram-user-crabbox-proof}"
"$proof_cmd" start \
--tdlib-url http://artifacts.openclaw.ai/tdlib-v1.8.0-linux-x64.tgz \
--mock-response-file .artifacts/qa-e2e/telegram-user-crabbox/reply.txt \
--output-dir .artifacts/qa-e2e/telegram-user-crabbox/pr-review
The runner defaults to --class standard, --record-fps 24,
--preview-fps 24, and --preview-width 1920. Keep those defaults unless the
proof needs something else.
For visual proof, first send or identify a bottom marker message, then open the group/topic directly by message id:
proof_cmd="${OPENCLAW_TELEGRAM_USER_PROOF_CMD:-openclaw-telegram-user-crabbox-proof}"
"$proof_cmd" view \
--session .artifacts/qa-e2e/telegram-user-crabbox/pr-review/session.json \
--message-id <message-id>
This uses Telegram Desktop directly with tg://privatepost, not xdg-open.
It also resizes Telegram to 650x1000 at the tested desktop position so
the crop can isolate the chat pane even if Telegram keeps a split/sidebar
layout. Do not press Escape after this; Escape can close the selected chat.
Bottom behavior matters:
Send as the real Telegram user:
proof_cmd="${OPENCLAW_TELEGRAM_USER_PROOF_CMD:-openclaw-telegram-user-crabbox-proof}"
"$proof_cmd" send \
--session .artifacts/qa-e2e/telegram-user-crabbox/pr-review/session.json \
--text /status
For slash commands, omit the bot username; the runner targets the SUT bot.
Run arbitrary commands on the Crabbox:
proof_cmd="${OPENCLAW_TELEGRAM_USER_PROOF_CMD:-openclaw-telegram-user-crabbox-proof}"
"$proof_cmd" run \
--session .artifacts/qa-e2e/telegram-user-crabbox/pr-review/session.json \
-- bash -lc 'source /tmp/openclaw-telegram-user-crabbox/env.sh && python3 /tmp/openclaw-telegram-user-crabbox/user-driver.py transcript --limit 20 --json'
Useful remote user-driver commands:
source /tmp/openclaw-telegram-user-crabbox/env.sh
python3 /tmp/openclaw-telegram-user-crabbox/user-driver.py status --json
python3 /tmp/openclaw-telegram-user-crabbox/user-driver.py chats --json
python3 /tmp/openclaw-telegram-user-crabbox/user-driver.py transcript --limit 20 --json
…
Fetch GitHub issues, create fixes, open PRs, and handle reviews.
Convert text to speech locally and offline with sherpa-onnx, no cloud needed.
Regenerate OpenClaw release changelog sections from Git history before releases.
Prepare and verify OpenClaw stable or beta releases and release notes.
Automate web page workflows, login checks, tab handling, and recovery steps.
Verify an OpenClaw release is fully published and working across all channels.
Run cross-platform remote validation with Crabbox and report the actual provider ID.
Run cross-platform OpenClaw remote validation with provider and lease reporting.
Run remote code validation, PR checks, and secure scripted workflows.
Automatically add redacted agent transcripts to GitHub PRs or issues.
Chat directly with the Discord-backed OpenClaw agent in real time.
Securely triage Telegram chats, search context, and draft authorized replies locally.