telegram-mini-app
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Telegram Web App JavaScript library (https://telegram.org/js/telegram-web-app.js). This is a standard and safe reference for the intended functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates how to access user data via the Telegram WebApp API (tg.initDataUnsafe.user). While this involves external data ingestion, the skill explicitly warns developers about the security risks of not validating this data on the server side under its Sharp Edges section.
- [DATA_EXPOSURE]: The skill shows how to retrieve user data from the client-side Telegram context. This is expected behavior for the stated purpose of building Telegram Mini Apps.
Audit Metadata