make-call
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to interact with Bolna AI's official infrastructure. Network requests are restricted to api.bolna.ai, which is the authoritative domain for the skill author. This aligns with the expected behavior for a vendor-provided integration tool.\n- [PROMPT_INJECTION]: The skill possesses a potential surface for indirect prompt injection. The bulk_make_calls.py script reads data from external CSV files and passes it as dynamic variables (user_data) to the voice AI agent. If the CSV content contains instructions designed to manipulate an LLM, it could influence the agent's interaction during the call.\n
- Ingestion points: The --file parameter in scripts/bulk_make_calls.py reads local CSV files.\n
- Boundary markers: No specific delimiters or markers are applied to the user_data payload before it is sent to the API.\n
- Capability inventory: The skill can perform network operations via urllib.request.urlopen in all three scripts (bulk_make_calls.py, make_call.py, schedule_call.py).\n
- Sanitization: No sanitization or validation of the CSV column values is performed beyond standard CSV parsing.
Audit Metadata