telegram-bot-weapon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow processes Telegram webhook/incoming updates (req.body / update objects) originating from end users/other chats, which can include user-authored free text that flows into the LLM context via the agent’s update-to-reasoning prompt path (classic indirect prompt-injection risk); this is reflected in the webhook setup described in SKILL.md/go-bot examples.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Mini App HTML in the guides loads and executes remote JavaScript at runtime from https://telegram.org/js/telegram-web-app.js, which is a required runtime dependency that runs remote code in the Mini App context.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The file research/mini-apps/2026-05-20-tma-js-init-data-node.md contains a literal, high-entropy Telegram bot token string ("5768337691:AAH5YkoiEuPk8-FZa32hStHTqXiLPtAEhx8") in example code. This matches Telegram bot-token format and is not a generic placeholder (e.g., YOUR_API_KEY) or a low-entropy setup password, so it meets the definition of an actual secret and should be treated as exposed credentials. Other occurrences of placeholders in the repo (for example, BOT_TOKEN=your_bot_token_here in examples) are documentation placeholders and were ignored.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents Telegram Payments (Stars) integration and references payment-specific API/actions: send_invoice parameters, pre_checkout_query handling, successful_payment handler, and provider_token behavior for Stars. These are specific payment APIs meant to initiate and handle monetary transactions (not generic tooling), so the skill grants direct financial execution capability.