telegram-mini-app

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill loads and executes the remote Telegram Web App library at runtime via the script URL https://telegram.org/js/telegram-web-app.js, which is fetched and runs code the app depends on for WebApp behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes crypto payment and wallet integration features that can initiate real transactions: TON Connect integration and a TonConnectButton for wallet connection, example code that calls tonConnectUI.sendTransaction(transaction) to send TON, and a bot example using ctx.replyWithInvoice to create payments/invoices. These are specific financial execution capabilities (crypto transactions and payment/invoice APIs), not generic utilities.