Skip to content

Automated Features

The bot runs several background processes that automatically detect, process, and respond to content shared in Signal chats. These features work without explicit commands - they trigger automatically when relevant content is detected.

All automated features can be enabled/disabled per room using !room commands:

!room # View all current settings
!room <feature> on/off # Toggle a specific feature
FeatureCommandDefaultDescription
Auto-Scan!room autoscan on/offONVirus scan & archive attachments
News Summarizer!room news on/offONAuto-post news articles to forum
Tracker Removal!room tracker on/offONStrip tracking params from URLs
Meme Reactions!room memereact on/offONAuto-respond to trigger words
Bot Master Switch!room bot on/offONDisable ALL bot features

When files are shared in a chat, the bot automatically:

  1. Virus Scans using ClamAV antivirus
  2. Archives clean files to MinIO S3 storage
  3. Reports results with file links

Scanned & Archived:

  • Documents: PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX
  • Text: TXT, MD, CSV, JSON, XML
  • Archives: ZIP, RAR, 7Z, TAR, GZ

Skipped (not scanned):

  • Images: JPG, PNG, GIF, WEBP (handled by Signal)
  • Videos: MP4, MOV, AVI (too large)
  • Audio: MP3, WAV, OGG
🛡️ Auto-Scan Results
📄 report.pdf
✅ Clean - No threats detected
📦 Size: 2.5 MB
📁 Archived: s3.irregular.chat/files/...
📄 data.xlsx
✅ Clean - No threats detected
📁 Archived: s3.irregular.chat/files/...

If a virus is detected:

  • File is NOT archived
  • Warning sent privately to uploader via DM
  • No public alert (to avoid embarrassment)
!room autoscan off # Disable auto-scanning for this room
!room autoscan on # Re-enable auto-scanning

When news URLs are shared, the bot automatically:

  1. Detects news domains (400+ news sites supported)
  2. Scrapes article content using multi-strategy extraction
  3. Generates AI summary using OpenAI
  4. Posts to forum (forum.irregularchat.com)
User shares: https://arstechnica.com/article/...
Bot automatically:
1. Extracts article title, content
2. Generates 2-3 sentence AI summary
3. Posts to forum with link back to Signal discussion
4. Replies in chat with forum link

The bot recognizes 400+ news domains including:

Major News: NYTimes, Washington Post, BBC, CNN, Reuters, AP News, NPR, Guardian

Tech News: Ars Technica, TechCrunch, The Verge, Wired, Engadget, ZDNet

Business: Bloomberg, Forbes, WSJ, CNBC, Business Insider

Defense/Military: Defense One, Breaking Defense, C4ISRNet, War on the Rocks, Defense News

Science: Nature, Science, Scientific American, MIT Technology Review

The bot skips (doesn’t auto-post):

  • Social media (Instagram, TikTok, YouTube, Twitter)
  • Community sites (irregularpedia.org, irregularchat.com)
  • File hosting (Dropbox, Google Drive, GitHub)
!room news off # Disable news auto-posting for this room
!room news on # Re-enable news auto-posting

When URLs are shared, the bot automatically strips tracking parameters and alerts on suspicious domains.

Google Analytics:

  • utm_source, utm_medium, utm_campaign, utm_term, utm_content
  • gclid, gclsrc, dclid, gbraid, wbraid

Facebook/Meta:

  • fbclid, fb_action_ids, fb_ref, fb_source
  • mibextid, sfnsn, _rdr

Instagram:

  • igsh, igshid, ig_rid

Other Platforms:

  • LinkedIn: trk, trkInfo, lipi, rcm
  • Twitter: twclid, s, t
  • TikTok: tt_medium, tt_content, _r
  • YouTube: si, pp, feature
User shares: https://instagram.com/p/ABC123/?igsh=xyz&utm_source=copy
Bot responds:
🔗 Clean URL: https://instagram.com/p/ABC123/
📊 Removed: igsh, utm_source

The bot alerts on URLs from high-risk TLDs:

TLDCountryRisk
.ru, .suRussiaHigh
.cn, .com.cnChinaHigh
.irIranHigh
.kpNorth KoreaHigh
.tk, .ml, .gaFree TLDsPhishing

Example Alert:

⚠️ Security Alert
URL from suspicious domain detected:
🔗 example.ru
Country: Russia
Risk: High-risk TLD often associated with malicious content
Proceed with caution. Do not enter credentials.
!room tracker off # Disable tracker removal for this room
!room tracker on # Re-enable tracker removal

When social media URLs are shared, the bot:

  1. Cleans tracking params (igsh, fbclid, etc.)
  2. Identifies content type (Reel, Tweet, Video, etc.)
  3. Saves to database for later discovery via !links
  • Instagram (Posts, Reels, Stories)
  • TikTok (Videos)
  • Twitter/X (Tweets, Threads)
  • YouTube (Videos, Shorts, Live)
  • Facebook (Posts, Videos, Reels)
  • Reddit (Posts, Comments)
  • LinkedIn (Posts, Articles)
!links -social # View recent social media links
!links -social -t 7d # Last 7 days
!links -c -social # This group only

When GitHub/GitLab URLs are shared, the bot:

  1. Detects repository URLs
  2. Extracts repo metadata (name, description, stars)
  3. Generates AI summary of the project
  4. Saves to database for discovery
User shares: https://github.com/anthropics/claude-code
Bot responds:
📦 Repository: anthropics/claude-code
⭐ Stars: 12.5k
📝 AI Summary: CLI tool for interacting with Claude AI...
Saved to !links -git
!links -git # View shared git repositories
!links -git -t 30d # Last 30 days

The bot can automatically respond with memes when trigger words are detected.

  1. Admin sets trigger words for a meme: !meme trigger 42 potato spud
  2. When someone says “potato” or “spud” in chat
  3. Bot has a chance to respond with meme #42
  • Not every trigger fires (probability-based)
  • Cooldown prevents spam (can’t trigger same meme twice in short period)
  • Only works in group chats
!room memereact off # Disable auto meme reactions
!room memereact on # Re-enable auto meme reactions

Identity Fingerprint Polling (Safety Number Detection)

Section titled “Identity Fingerprint Polling (Safety Number Detection)”

The bot polls signal-cli’s identity store every 5 minutes to detect safety number changes that are silently auto-trusted.

  1. Calls listIdentities via JSON-RPC (returns ~2300+ identities with fingerprints)
  2. Compares each fingerprint against the stored value in known_identity_fingerprints table
  3. If a fingerprint changed AND the user is in a community group:
    • Triggers the safety number verification flow
    • Adds user to Entry/INDOC with 24h deadline
    • Notifies admins in Actions chat
    • Logs the change in identity_change_log

Signal-cli runs with --trust-new-identities always, which silently auto-trusts new identity keys without throwing UntrustedIdentityException. The exception-based detection missed many safety number changes. Polling closes this gap.

Terminal window
# Check polling logs
docker logs signal-bot-selfhosted-signal-bot-1 2>&1 | grep IDENTITY_POLL
# Check detected changes
docker exec signal-bot-postgres psql -U signal_bot -d signal_bot \
-c "SELECT * FROM identity_change_log ORDER BY detected_at DESC LIMIT 5;"
  • Interval: 5 minutes (hardcoded as IDENTITY_POLL_INTERVAL)
  • First poll: 30 seconds after startup (seeds database without alerting)
  • Scope: Only triggers for users who are members of at least one community group
  • Cannot be disabled per-room (runs globally)

FeatureTriggerOutputToggle
Auto-ScanFile attachmentVirus report + archive link!room autoscan
News SummarizerNews URL sharedForum post + AI summary!room news
Tracker RemovalAny URL with trackingClean URL reply!room tracker
Suspicious DomainHigh-risk TLDSecurity alertAlways on
Social MediaSocial URL sharedClean URL + saved!room tracker
Git RepoGitHub/GitLab URLAI summary + savedAlways on
Meme ReactionsTrigger wordsMeme GIF!room memereact
Identity PollingEvery 5 minSafety number flowAlways on

These environment variables control automated features:

Terminal window
# Forum posting
DISCOURSE_URL=https://forum.irregularchat.com
DISCOURSE_API_KEY=xxx
DISCOURSE_API_USERNAME=bot
DISCOURSE_CATEGORY_ID=5
# File archiving
MINIO_ENDPOINT=http://minio:9000
MINIO_ACCESS_KEY=xxx
MINIO_SECRET_KEY=xxx
MINIO_BUCKET=irregularchat
MINIO_PUBLIC_URL=https://s3.irregular.chat
# AI summaries
OPENAI_API_KEY=sk-xxx
# Community domains to skip (comma-separated)
COMMUNITY_DOMAINS=irregularpedia.org,irregularchat.com,irregular.chat