sinch-conversation-api
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enables interaction with the Sinch Conversation API for omnichannel messaging (SMS, WhatsApp, RCS, etc.) and follows industry security standards.
- [SAFE]: Credential management is handled securely by instructing users to use environment variables for sensitive keys (e.g.,
SINCH_KEY_SECRET), with explicit warnings against hardcoding secrets. - [SAFE]: Node.js scripts provided in the
scripts/directory utilize built-in modules likehttpsandcryptofor API interactions, ensuring no reliance on external third-party dependencies. - [SAFE]: A dedicated security section in
SKILL.mdidentifies the risk of indirect prompt injection from inbound webhook data (MESSAGE_INBOUND) and provides mitigation strategies, such as treating all user-generated content as untrusted and performing strict validation. - [SAFE]: All network operations are directed towards official Sinch domains (
*.sinch.com) for authentication and messaging services.
Audit Metadata