telnyx-messaging-javascript
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official Telnyx JavaScript SDK (
telnyx@6.74.2) from the npm registry to facilitate communication with the messaging service. - [INDIRECT_PROMPT_INJECTION]: The functionality to receive and process inbound messages provides a vector for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through the
data.payload.textfield of theinboundMessagewebhook defined inSKILL.md. - Boundary markers: The instructions do not specify boundary markers or 'ignore' directives to prevent the agent from executing instructions embedded in the message text.
- Capability inventory: The skill includes sensitive capabilities such as sending outbound messages, deleting alphanumeric sender IDs, and regenerating messaging profile secrets.
- Sanitization: There is no mention of input sanitization or validation logic for the content of received messages.
Audit Metadata