telnyx-video-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses when listing rooms, participants, and recordings. This introduces a surface where malicious content in resource metadata could influence agent behavior.
- Ingestion points: API response objects in loops such as
client.roomParticipants.list()(SKILL.md). - Boundary markers: Absent; external data is not delimited from instructions.
- Capability inventory: SDK network calls and console output (SKILL.md).
- Sanitization: No filtering or sanitization of API data is demonstrated.
- [OBFUSCATION]: Contains a Base64-encoded JWT as a documentation example for the
refreshClientTokenendpoint. Decoding confirms it is an expired, benign example token from May 2020. - [SAFE]: Employs the official
telnyxSDK and properly manages API credentials using environment variables (process.env['TELNYX_API_KEY']).
Audit Metadata