azure-communication-callautomation-java
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official
com.azure:azure-communication-callautomationlibrary. This is a legitimate SDK dependency provided by Microsoft for interacting with Azure Communication Services. - [COMMAND_EXECUTION]: The skill includes functionality for downloading media files to a local path (
recording.mp4). This is a documented feature required for handling call recordings and is used within the expected context of the library's features. - [PROMPT_INJECTION]: The skill processes external data such as DTMF tones and speech recognition results via ACS webhooks. This constitutes a potential surface for indirect prompt injection, as the agent may process instructions provided by a call participant via audio or keypad input.
- Ingestion points: Webhook callback payloads parsed by
CallAutomationEventParserinSKILL.md. - Boundary markers: None identified in the provided boilerplate code.
- Capability inventory: File system access (recording downloads) and call management operations via the Azure SDK.
- Sanitization: The provided code snippets do not include explicit sanitization or validation of strings or tones captured from participants.
Audit Metadata