azure-communication-callautomation-java
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: References the 'com.azure:azure-communication-callautomation' Maven dependency. This is an official library provided by Microsoft (a well-known technology service provider).
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing untrusted external data that enters the agent's context through specific ingestion points.
- Ingestion points: The
handleCallbackmethod in the webhook handler parses an externalrequestBody, and theRecognizeCompletedevent processes DTMF tones and speech-to-text results. - Boundary markers: None identified in the provided code snippets to delimit external data from instruction logic.
- Capability inventory: The skill demonstrates capabilities including network operations via the Azure SDK (client creation, call management) and file system writes (
callRecording.downloadTo). - Sanitization: No explicit sanitization or validation of the input received from the ACS webhook or recognition results is shown in the examples.
Audit Metadata