telegram-mini-app
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Telegram Web App script from the well-known service telegram.org for native API integration.
- [COMMAND_EXECUTION]: Suggests the installation of the @tonconnect/ui-react package via npm for standard Web3 wallet connectivity.
- [PROMPT_INJECTION]: Evaluated the skill for indirect prompt injection vulnerabilities. Ingestion points: User data enters the application context via tg.initDataUnsafe as shown in SKILL.md. Boundary markers: Not explicitly provided in the code templates. Capability inventory: Facilitates UI rendering of user data and TON blockchain transaction signing. Sanitization: While code snippets are minimalist templates, the skill correctly identifies data validation as a high-severity concern in the Sharp Edges section and advises developers on proper validation.
Audit Metadata