sinch-functions-node
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is architected to ingest and act upon data from external, untrusted sources including inbound call menu responses, SMS/WhatsApp message contents, and custom HTTP request payloads. This creates a potential surface for indirect prompt injection if the processed data is used to influence the agent's decision-making or execution flow.
- Ingestion points: Untrusted data enters the context via handler parameters in
function.ts, specifically withinonCalllifecycle events,conversationWebhookpayloads, and custom HTTP export arguments. - Boundary markers: The skill includes proactive documentation in
SKILL.mdunder the 'Security' section, warning developers that callback data is untrusted and should not be interpolated into prompts. - Capability inventory: The environment allows for significant operations including outbound network requests (Voice, SMS, Conversation APIs), durable file storage writes (
context.storage), and SQLite database execution (context.database). - Sanitization: The documentation explicitly advocates for sanitization techniques, such as mandatory use of parameterized queries for database operations and validation of request body shapes and sizes.
Audit Metadata