sinch-in-app-calling
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches the Sinch RTC SDK from official vendor distribution channels. This includes the JavaScript SDK from the Sinch CDN (
cdn.sinch.com), the iOS SDK via the vendor's GitHub repository for Swift Package Manager, and the Android SDK via Maven Central or direct AAR downloads fromdownload.sinch.com. - [COMMAND_EXECUTION]: Contains instructions for standard developer tools including Gradle (Android), npm/script tags (JavaScript), and Xcode/SPM (iOS) to facilitate SDK integration into user projects.
- [PRIVILEGE_ESCALATION]: The integration guides for mobile platforms declare the necessity of standard VoIP and video calling permissions, such as
INTERNET,RECORD_AUDIO,CAMERA, andREAD_PHONE_STATE. These are documented as required for the primary functionality of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user project context (such as platform, language, and build system) and external documentation from
developers.sinch.comto guide the integration process. - Ingestion points: Platform detection from user project details and documentation retrieval from vendor-controlled domains (SKILL.md).
- Boundary markers: Utilizes a clear instructional hierarchy and explicit "Source of Truth" rules to prioritize authoritative vendor documentation over navigational summaries.
- Capability inventory: The skill provides code generation and documentation navigation; it does not execute arbitrary shell commands or code on user-supplied data.
- Sanitization: The instructions guide the agent to verify implementation steps with the user before proceeding.
Audit Metadata