sinch-number-order-api
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests data from external API responses and webhook callbacks, creating a surface for indirect prompt injection.
- Ingestion points: Data is ingested from the Sinch API response in Step 1 (KYC fields and requirements) and from inbound payloads delivered to the user-specified callbackUrl.
- Boundary markers: The skill includes a dedicated security section instructing the agent to treat callback bodies as untrusted input and provides explicit domain restrictions for URL fetching.
- Capability inventory: The skill uses curl to perform network operations and generates implementation code for the user.
- Sanitization: The instructions mandate that the agent sanitize callback content before logging, rendering, or interpolating it into prompts/code.
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and authoritative documentation from developers.sinch.com and dashboard.sinch.com, which are official vendor resources for this skill.
Audit Metadata