telegram-mini-app
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Telegram Web App script from
https://telegram.org/js/telegram-web-app.js. This is a well-known service and the reference is for standard platform functionality. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates usage of
tg.initDataUnsafe.userinSKILL.md, which ingests data provided by the Telegram client environment. The skill correctly identifies the lack of validation as a high-severity issue in the 'Sharp Edges' section, providing a warning to developers to validate data. - [REMOTE_CODE_EXECUTION]: The setup instructions include
npm install @tonconnect/ui-react. This is a standard dependency for TON blockchain integration within the Telegram ecosystem and represents normal development workflow.
Audit Metadata