sinch-rcs
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage sensitive information like API keys and secrets using environment variables, avoiding hardcoded credentials in the source code or command history.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and OpenAPI specifications hosted on official Sinch developer domains (developers.sinch.com). These are trusted resources for the vendor's own API integration.
- [DATA_EXFILTRATION]: Network communication is exclusively directed to the vendor's authentication and messaging endpoints (auth.sinch.com and *.conversation.api.sinch.com), ensuring data is only sent to the intended service provider.
- [PROMPT_INJECTION]: The skill includes proactive security guidance regarding indirect prompt injection, explicitly warning developers to treat inbound message payloads and postback data as untrusted content that should not be evaluated or interpolated into prompts.
- [COMMAND_EXECUTION]: The provided Node.js scripts are developer tools designed to perform specific API tasks. They use standard libraries for HTTPS requests and do not contain any malicious or obfuscated logic.
Audit Metadata