sinch-elastic-sip-trunking
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill provides troubleshooting instructions that suggest using
curl ifconfig.meto determine the user's public IP address for Access Control List (ACL) configuration. While this involves a request to a third-party utility service, it is a standard practice for network configuration and does not involve the exfiltration of sensitive credentials or private data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied configuration parameters—such as trunk names, hostnames, and IP addresses—and interpolates them into REST API requests. While this creates a surface for indirect injection, the risk is minimal as the inputs are technical parameters for infrastructure provisioning, and the skill includes specific warnings about field-name traps and validation requirements.
- [CREDENTIALS_SAFE]: The skill includes explicit security guidelines for credential handling, instructing the user to store project IDs, keys, and secrets in environment variables rather than hardcoding them in source code or commands. It also warns against committing SIP digest credentials to avoid toll fraud.
Audit Metadata