sinch-voice-api
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices for API integration, including the use of environment variables for credentials and guidance on verifying callback signatures.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface involving the processing of untrusted data from voice callbacks. It provides explicit instructions to sanitize this input to prevent injection attacks. • Ingestion points: Data enters via the callback events defined in
references/callbacks.md. • Boundary markers: A Security section inSKILL.mdexplicitly warns the agent that callback body fields are untrusted. • Capability inventory: The skill includes Node.js scripts and SVAML commands for call management and network interaction. • Sanitization: The agent is instructed to sanitize all caller-supplied fields before they are used in logs or prompts.
Audit Metadata