telegram-mini-apps-react
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the @tma.js/sdk-react library and utilize the @tma.js/create-mini-app scaffolding tool.
- [COMMAND_EXECUTION]: Provides example shell commands for package installation and project initialization.
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to parse tgWebAppStartParam from deep links, creating a surface for untrusted external data to influence application routing and state.
- Ingestion points: initData.startParam() in references/deeplink.md.
- Boundary markers: Absent.
- Capability inventory: navigate() for routing, analytics.track() for telemetry, and localStorage.setItem() for data persistence.
- Sanitization: The implementation uses atob for decoding and URLSearchParams for parsing.
- [DYNAMIC_EXECUTION]: The initialization routine uses a dynamic import() call to load the eruda mobile console during development.
- [DATA_EXFILTRATION]: Contains code examples for transmitting user profile information and signed initialization data to an external API (such as api.example.com) for authentication and analytics.
Audit Metadata