telnyx-verify-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official
telnyxpackage from the npm registry. This is a verified SDK from a well-known service provider and is appropriate for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external API responses (e.g., caller names and carrier information). While this introduces a surface for indirect prompt injection if the upstream data is untrusted, the skill uses this data for standard verification logic and does not exhibit any specific vulnerabilities. No boundary markers or sanitization logic are explicitly demonstrated in the code snippets.
- [SAFE]: The skill correctly uses environment variables (
process.env['TELNYX_API_KEY']) for authentication rather than hardcoding credentials. It also includes comprehensive error handling for common API failure modes, which is a best practice for production integrations.
Audit Metadata