telegram-mini-app

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill loads and executes remote JavaScript at runtime from https://telegram.org/js/telegram-web-app.js via a tag, which is a required runtime dependency that executes fetched code and provides control APIs used throughout the skill.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes blockchain payment and invoicing functionality: it documents TON Connect integration and shows code that calls tonConnectUI.sendTransaction to send TON, and it includes a bot.replyWithInvoice example to request payments (Telegram Stars). These are specific, purpose-built financial transaction APIs (crypto transactions and invoice/payment requests), which grant direct financial execution capability.