The Agent Skills Directory

[SAFE]: The skill provides robust security guidance for authenticating Telegram Mini App users. It correctly implements server-side HMAC-SHA256 verification using the required WebAppData key derivation and employs constant-time string comparisons via hmac.compare_digest to prevent timing attacks.\n- [SAFE]: The provided implementations include critical replay protections. The code validates the auth_date parameter against a defined freshness window and recommends exchanging verified initialization data for short-lived session tokens to minimize the attack surface.\n- [SAFE]: The skill highlights the risks of trusting client-side data, explicitly warning developers not to use initDataUnsafe for authorization decisions and instead directing them to verify the raw initialization string on the backend.\n- [SAFE]: All provided code fixtures rely exclusively on standard Python and Node.js libraries, avoiding external dependencies for core cryptographic operations. The documentation also provides neutral references to well-known resources, such as official Telegram API documentation and community-maintained SDKs for the platform.

telegram-miniapps