telegram-mini-app
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Telegram Web App script from telegram.org, which is an established and well-known service.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates handling data from the tg.initDataUnsafe object, which contains untrusted user input from the Telegram client environment.\n
- Ingestion points: SKILL.md examples access tg.initDataUnsafe.user and tg.initDataUnsafe.query_id.\n
- Boundary markers: The skill author includes a dedicated 'Sharp Edges' section that explicitly warns developers about the security necessity of validating initData from Telegram.\n
- Capability inventory: The skill demonstrates UI-level interactions, wallet connection via TON Connect, and standard Telegram Bot API commands; it does not request or use capabilities for file system modification, network exfiltration, or arbitrary command execution.\n
- Sanitization: The skill emphasizes the requirement for server-side validation in its documentation.
Audit Metadata