sinch-sdks
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install Sinch SDKs via official package registries, including npm (
@sinch/sdk-core), pip (sinch), Maven (com.sinch.sdk:sinch-sdk-java), and NuGet (Sinch). These are legitimate, vendor-provided packages. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch authoritative documentation from
developers.sinch.comand follow links to verify field names and schemas. While this represents an external data ingestion surface, it is directed toward the vendor's official documentation and is necessary for the skill's primary purpose. - Ingestion points:
developers.sinch.comanddevelopers.sinch.com/llms.txt(SKILL.md). - Boundary markers: The skill provides guidance on data precedence but does not include explicit delimiters to separate fetched documentation from agent instructions.
- Capability inventory: The skill provides code templates for SDK initialization but does not include any executable scripts, tool definitions, or command-execution capabilities.
- Sanitization: No explicit sanitization or filtering of the fetched documentation content is described in the skill instructions.
Audit Metadata