The Agent Skills Directory

[SAFE]: The skill correctly implements the Telegram Bot API authentication scheme for Mini Apps. The validation logic in scripts/init_data.py uses hmac.compare_digest to prevent timing attacks and includes an auth_date check to ensure the freshness of the authentication data.\n- [DYNAMIC_EXECUTION]: The test files tests/test_init_data.py and tests/test_ed25519.py use importlib.util to load the local scripts/init_data.py file.\n
Evidence: importlib.util.spec_from_file_location calls in test scripts.\n
Context: This is a standard pattern for unit testing where scripts are loaded dynamically from stable relative paths within the skill's own directory. It does not load external or untrusted code.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external initData from the Telegram client.\n
Ingestion points: raw_init_data input in scripts/init_data.py.\n
Boundary markers: The implementation uses cryptographic validation (HMAC/Ed25519) as a mandatory trust gate.\n
Capability inventory: The skill only parses and returns the validated fields; it does not perform automated actions or command execution based on the data.\n
Sanitization: Strict signature verification against a bot_token or public key is performed before any data is processed, mitigating the risk of processing malicious inputs.

tg-miniapp-launch-auth