telegram-mini-app
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [METADATA_POISONING]: The skill's YAML frontmatter includes a
risk: criticalfield. While unusual for a technical guide, analysis of the skill body confirms no malicious intent or dangerous capabilities. This appears to be a user-defined label rather than a deceptive practice. - [EXTERNAL_DOWNLOADS]: The skill references standard dependencies and external scripts from well-known and official sources:
- Loads the official Telegram Web App SDK from
https://telegram.org/js/telegram-web-app.js. - Recommends installation of the
@tonconnect/ui-reactpackage, which is the official UI library for TON blockchain integration. - [SAFE]: The skill proactively addresses security risks by providing a complete Node.js implementation for validating
initDatausing HMAC-SHA256 to prevent user spoofing and data tampering. It also emphasizes the importance of using HTTPS and real-device testing for financial transactions.
Audit Metadata