telegram-mini-app
Build Telegram Mini Apps With TON
Telegram Mini Apps require platform APIs, mobile UX, payments, and TON wallet patterns. This skill gives concise patterns for setup, monetization, referrals, and launch planning.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "telegram-mini-app" from https://skillstore.io/skills/sickn33-telegram-mini-app.md and its manifest at https://skillstore.io/api/skills/sickn33-telegram-mini-app/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "telegram-mini-app". I need a first plan for a Telegram quiz Mini App.
Expected outcome:
A concise launch outline with bot entry flow, mobile screens, Telegram API setup, and retention ideas.
Using "telegram-mini-app". I want to add TON wallet payments.
Expected outcome:
A payment plan covering wallet connection, transaction flow, manifest needs, and validation checkpoints.
Using "telegram-mini-app". My Mini App feels slow inside Telegram.
Expected outcome:
A performance review with loading states, Telegram frame constraints, and mobile testing actions.
Security Audit
High RiskThe static command findings are false positives caused by Markdown code fences and JavaScript template literals. The hardcoded URLs are official Telegram endpoints or placeholders for examples. I found one substantive issue: the skill shows initDataUnsafe user access but does not include backend initData validation.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (27)
🌐 Network access (7)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-telegram-mini-app/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-telegram-mini-app?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-telegram-mini-app?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-telegram-mini-app/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-telegram-mini-app.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). telegram-mini-app security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-telegram-mini-app/audits/4BibTeX citation
@techreport{sickn33-sickn33-telegram-mini-app-2026,
author = {sickn33},
title = {telegram-mini-app security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-telegram-mini-app/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "telegram-mini-app security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-telegram-mini-app/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-telegram-mini-app:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Prototype a Mini App
Plan the first mobile-first Telegram flow with Web App API setup and bot entry points.
Add TON Payments
Map wallet connection, TON transactions, and Stars purchases before implementation.
Improve Retention
Review referral, daily reward, and Telegram-native UX ideas for a launch plan.
Try These Prompts
Help me design a Telegram Mini App for [use case]. Include bot entry points, Web App API setup, and mobile-first UX requirements.
Review my Mini App concept. Suggest Telegram MainButton, theme, loading, and sharing patterns that fit the user flow.
Create an implementation plan for TON Connect and Telegram Stars in my Mini App. Include trust boundaries and validation checkpoints.
Evaluate my Mini App launch plan for authentication, payment safety, performance, referrals, and Telegram platform compliance.
Best Practices
- Validate Telegram initData on the backend before trusting identity or payments.
- Design mobile-first screens that follow Telegram theme colors and native controls.
- Replace placeholder domains with verified production URLs before launch.
Avoid
- Do not trust initDataUnsafe as proof of identity.
- Do not design desktop-first flows for Telegram users.
- Do not launch payment or referral flows without abuse checks.