azure-communication-callautomation-java
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill handles external data inputs such as DTMF tones and speech recognition results via webhooks.
- Ingestion points: Webhook event parsing demonstrated in
SKILL.mdandreferences/examples.md. - Boundary markers: The provided examples do not include explicit delimiters or "ignore embedded instructions" warnings for the external event data processed by the agent.
- Capability inventory: The skill provides capabilities to perform significant actions including
createCall,transferCall, andstartRecordingbased on incoming event data. - Sanitization: Implementation should include validation of incoming webhook signatures and sanitization of recognition output to ensure call flows are not manipulated by external inputs.
Audit Metadata