The Agent Skills Directory

[SAFE]: The skill focuses on securing Telegram Mini Apps by enforcing server-side verification of initData using HMAC-SHA256. It correctly identifies high-risk practices, such as trusting client-side initDataUnsafe or using weak comparison methods for digests.
[SAFE]: The included Python script (fixtures/verify_initdata.py) is a self-contained test suite that uses only standard library modules to demonstrate correct verification and refusal of tampered, stale, or incorrectly signed data. It serves as a pedagogical tool rather than a malicious payload.
[SAFE]: Guidance on handling user input from sendData correctly classifies it as untrusted data that requires validation on the bot's backend, preventing potential injection or privilege escalation attacks through crafted messages.
[SAFE]: References to external libraries, such as the @telegram-apps/sdk and the community-maintained Go implementation, are appropriate for the context and do not involve suspicious download or execution patterns.

telegram-miniapps