- name
- telegram-miniapp-security-auditor
- description
- Audit Telegram Mini App projects for launch safety before connecting bot tokens or public channels. Use when Codex needs to review a Telegram WebApp/Mini App, TMA frontend, FastAPI/Node backend, BotFather launch runbook, Colab/ngrok deployment, or OpenClaw/Codex skill that handles Telegram initData, bot tokens, admin endpoints, CORS, PII, request forms, or public channel launch readiness.
- version
- 1.0.2
- homepage
- https://github.com/zack-dev-cm/telegram-miniapp-security-auditor
- license
- MIT-0
- user-invocable
- true
- metadata
- {"openclaw":{"homepage":"https://github.com/zack-dev-cm/telegram-miniapp-security-auditor","skillKey":"telegram-miniapp-security-auditor","requires":{"anyBins":["python3","python"]}}}
Telegram Mini App Security Auditor
Audit Telegram Mini Apps with a static, evidence-first workflow. Prefer the bundled script for repeatability, then inspect the flagged files before giving launch advice.
Quick Start
Run the static auditor from the skill folder:
python3 {baseDir}/scripts/audit_tma.py \
/path/to/project \
--out-dir /tmp/tma-auditExpected outputs:
tma_security_audit.jsontma_security_audit.md
Decision meanings:
PASS: no blocking or review-triggering evidence found by this static pass.REVIEW: launch only after a human verifies the listed risks.BLOCK: do not launch or connect production bot tokens until fixed.
Workflow
- Run
scripts/audit_tma.pyagainst the project root or Mini App subdirectory. - Read the Markdown report and inspect every
BLOCKandREVIEWfile reference. - If the app is not detected as a Telegram Mini App, confirm whether the user passed the correct path.
- For production launch, require all of these:
- server-side Telegram initData validation, - no committed bot tokens or token-like literals, - admin endpoints protected by server-side authorization, - no broad CORS in production, - request forms reject or avoid contact details, handles, secrets, and payment terms when governance requires it, - local/browser QA evidence before BotFather or channel changes.
- If packaging as a ClawHub/Codex skill, run TrustClaw after this audit:
trustclaw scan /path/to/skill --format markdownFinding Triage
Treat script output as static evidence, not a final proof of safety.
hardcoded-telegram-token: alwaysBLOCK; rotate the token if it was committed.initdata-no-server-validation:BLOCK; Mini App users must not be trusted from client-side data alone.insecure-initdata-bypass: usuallyREVIEW; acceptable only for clearly documented local dev commands and disabled-by-default server behavior.cors-wildcard:REVIEW, orBLOCKif credentials are also enabled.admin-endpoint-without-guard:BLOCK.unsafe-innerhtml:REVIEW; verify escaping or sanitization.
For detailed rules and manual checks, read references/tma-security-checklist.md only when needed.
Output Contract
When answering a user, lead with:
- decision,
- highest-severity findings with file paths,
- launch recommendation,
- artifacts produced,
- any limitations of the audit.
Keep live Telegram/BotFather/channel changes out of scope unless the user explicitly asks to launch and the project has passed audit and QA.