bolna-graph-agents
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that ingest untrusted user input during voice conversations, creating a potential surface for indirect instructions to influence agent behavior.
- Ingestion points: User utterances are processed in conversation nodes and can be captured as variables via the
parametersfield in edges, as seen inSKILL.mdandassets/full-example.json. - Boundary markers: The documentation and examples do not explicitly demonstrate the use of delimiters (such as XML tags or triple quotes) when interpolating user-provided variables into subsequent node prompts, such as the
{order_id}variable used inassets/full-example.json. - Capability inventory: The agents created can execute tool calls (e.g.,
transfer_call_main) and trigger state transitions through the defined graph structure. - Sanitization: The provided documentation and helper scripts do not describe or implement validation or sanitization for data captured from user input before it is interpolated into LLM prompts.
Audit Metadata