sinch-10dlc
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied registration data and fetches external documentation, creating an attack surface for indirect prompt injection.
- Ingestion points: User-provided brand and campaign details (e.g., company descriptions, message flows) and documentation content fetched from
developers.sinch.com(referenced inSKILL.mdandreferences/workflow.md). - Boundary markers: None explicitly defined for user-supplied string fields; the agent is instructed to follow links from a trusted root documentation page.
- Capability inventory: Performs network requests via
curltous10dlc.numbers.api.sinch.comto register brands and campaigns as described inSKILL.mdandreferences/workflow.md. - Sanitization: The skill lacks explicit programmatic sanitization but instructs the agent to manually verify all fields and enums against authoritative schemas before construction.
- [EXTERNAL_DOWNLOADS]: Fetches documentation, request/response schemas, and OpenAPI specifications from the vendor's official developer portal (
developers.sinch.com). - [COMMAND_EXECUTION]: Generates and executes
curlcommands to interact with the Sinch 10DLC REST API for registration and status checking.
Audit Metadata