telnyx-sip-integrations-java

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed service-account credentials (private_key, private_key_id, etc.) directly into request objects (JsonValue.from("bar")), which would require the agent to include secret values verbatim when creating/updating Dialogflow or storage credentials.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md shows the media upload endpoint accepts an arbitrary media_url (e.g., "http://www.example.com/audio.mp3") which the service will fetch and can be transcribed/retrieved via the recording_transcriptions endpoints, so untrusted web-hosted content can be ingested and influence subsequent agent behavior.