twilio-voice

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In get_live_transcript / get_live_session for start_live_call, the tool returns caller-provided transcript text (DTMF/speech) which is then ingested into the agent’s LLM context as free-form content, creating an indirect prompt-injection path from an outsider (the phone caller).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill permits providing a twiml_url (a public URL returning TwiML) which the system/Twilio will fetch at call time and whose fetched TwiML directly controls call prompts and flow (for example any public TwiML URL such as https://example.com/twiml.xml), so this is a runtime external dependency that can control agent instructions.