agents
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an environment where agents process untrusted user speech and external API data, creating potential surfaces for indirect prompt injection.
- Ingestion points: Transcripts from automated speech recognition (ASR), data returned from server-side webhook tools, and input from client-side JavaScript tools (SKILL.md, references/client-tools.md).
- Boundary markers: The platform settings include configurable guardrails specifically for detecting prompt injection and instruction overrides (references/agent-configuration.md).
- Capability inventory: Agents can execute server-side webhooks (POST/GET), run JavaScript in the client browser, and trigger outbound telephony via Twilio (SKILL.md, references/outbound-calls.md).
- Sanitization: The skill documents built-in PII redaction for conversation history and content moderation thresholds for various categories (references/agent-configuration.md).
- [EXTERNAL_DOWNLOADS]: Fetches the ElevenLabs conversational widget script from unpkg.com, a well-known and established CDN for JavaScript packages (references/widget-embedding.md).
- [CREDENTIALS_UNSAFE]: Provides instructions for managing the ElevenLabs API key, including its storage in environment variables or a local configuration file at
~/.agents/api_keys.json(SKILL.md, references/installation.md). - [METADATA_POISONING]: The documentation contains references to several non-existent or futuristic AI models (e.g., 'gpt-5', 'claude-sonnet-4-6', 'gemini-3.1'), which may be misleading for users regarding current technical capabilities (SKILL.md, references/agent-configuration.md).
Audit Metadata