skills/sinch/skills/sinch-10dlc/Gen Agent Trust Hub

sinch-10dlc

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied registration data and fetches external documentation, creating an attack surface for indirect prompt injection.
  • Ingestion points: User-provided brand and campaign details (e.g., company descriptions, message flows) and documentation content fetched from developers.sinch.com (referenced in SKILL.md and references/workflow.md).
  • Boundary markers: None explicitly defined for user-supplied string fields; the agent is instructed to follow links from a trusted root documentation page.
  • Capability inventory: Performs network requests via curl to us10dlc.numbers.api.sinch.com to register brands and campaigns as described in SKILL.md and references/workflow.md.
  • Sanitization: The skill lacks explicit programmatic sanitization but instructs the agent to manually verify all fields and enums against authoritative schemas before construction.
  • [EXTERNAL_DOWNLOADS]: Fetches documentation, request/response schemas, and OpenAPI specifications from the vendor's official developer portal (developers.sinch.com).
  • [COMMAND_EXECUTION]: Generates and executes curl commands to interact with the Sinch 10DLC REST API for registration and status checking.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 01:06 PM