telnyx-numbers-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API calls, specifically through
client.comments.list()andclient.comments.retrieve(), which return abodyfield containing user-supplied text content.\n - Ingestion points: The
bodyfield is defined as a response schema for comment operations inreferences/api-details.md.\n - Boundary markers: The skill does not provide specific delimiters or instructions to ignore potential commands embedded within comment data.\n
- Capability inventory: The skill includes methods for provisioning resources, such as
client.numberOrders.create()andclient.phoneNumberBlocks.jobs.deletePhoneNumberBlock().\n - Sanitization: No explicit sanitization or filtering of the retrieved comment bodies is performed before the agent processes the information.\n- [EXTERNAL_DOWNLOADS]: The skill installs the
telnyxpackage from the npm registry, which is the official SDK for the Telnyx platform.\n- [SAFE]: The skill adheres to security best practices by using environment variables (TELNYX_API_KEY,TELNYX_PUBLIC_KEY) for API authentication instead of hardcoding secrets.
Audit Metadata