Telegram Mini App Dev

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:17 AM UTC
• Version: 1.0.1

Overview

This is a focused Telegram Mini App helper; its main caution is manual deployment guidance that uses an unpinned npx command.

Installers should treat this as benign development guidance, but pin Wrangler and other deployment tools in project dependencies with a lockfile before using the deployment commands, and avoid enabling the debug overlay in production unless intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/KNOWLEDGE.md:349

Finding

Unpinned Third-Party Package Execution During Deployment

Content

View full analysis

Vulnerability Details

File Location: references/KNOWLEDGE.md, lines 349–352
Vulnerability Type: Unpinned package execution and software supply-chain exposure
Risk Level: Medium

Complete Code Snippet:

bash

# Always staging first
npx wrangler pages deploy dist --project-name myapp-staging

# Production only after testing
npx wrangler pages deploy dist --project-name myapp

Technical Analysis

The deployment instructions invoke wrangler through npx without specifying a reviewed version. If Wrangler is not already installed locally, npx may retrieve and execute a mutable package version from the configured package registry.

The Skill does not require a pinned project dependency, committed lockfile, integrity verification, offline execution, or trusted registry configuration. Consequently, the code that executes on a developer workstation or CI runner may differ from the code reviewed when this Skill was audited.

This behavior is not necessary to achieve the Skill's declared Telegram Mini App functionality. Deployment can instead use a version-pinned, lockfile-verified local dependency with narrowly scoped credentials.

Attack Path

1. A developer or CI job follows the documented deployment command.
2. The environment does not contain a suitable local Wrangler installation.
3. npx resolves the unpinned wrangler package through the configured registry.
4. A compromised release, registry account, registry response, dependency, or malicious registry configuration supplies attacker-controlled code.
5. Package or CLI code executes with the permissions of the developer or CI process.
6. The malicious code can inspect accessible files, environment variables, deployment credentials, and the build workspace, and may alter the deployed artifact.

Exploitation depends on compromise or manipulation of the package supply chain; the audited repository itself does not contain a malicious Wr ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

1. Add Wrangler as an exact-version project development dependency rather than resolving it dynamically:

   bash

   npm install --save-dev --save-exact wrangler@<reviewed-version>
   

2. Commit the generated lockfile and review dependency changes before upgrades.
3. In CI, install dependencies reproducibly with:

   bash

   npm ci
   

4. Invoke only the installed local package and prevent network fallback where supported:

   bash

   npm exec --offline -- wrangler pages deploy dist --project-name myapp-staging
   npm exec --offline -- wrangler pages deploy dist --project-name myapp
   

5. Configure trusted registries explicitly and enable package provenance, integrity, and dependency scanning controls.
6. Use a narrowly scoped Cloudflare deployment token that can access only the required project and environment.
7. Separate staging and production credentials, require explicit production approval, and avoid exposing unrelated secrets to the deployment process.
8. Pin and review all CI actions and build-tool versions involved in deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

- **[references/components.tsx](references/components.tsx)** — Ready-to-use components (SafeAreaHeader, DebugOverlay)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.