telnyx-voice-advanced-curl
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official API endpoints at
api.telnyx.com. These are legitimate vendor resources for the author 'team-telnyx'. - [CREDENTIALS_UNSAFE]: Authentication is handled via a placeholder environment variable (
TELNYX_API_KEY), which is the recommended method for managing secrets in scripts. - [INDIRECT_PROMPT_INJECTION]: The skill documents webhook events that include
client_state, which is a base64-encoded field controlled by the user. While this represents an ingestion point for external data, the skill consists of static documentation and examples without logic that would execute or process this data in a dangerous way. - [OBFUSCATION]: A base64 string
aGF2ZSBhIG5pY2UgZGF5ID1dis provided as an example for theclient_statefield. This decodes to 'have a nice day =]' and is a benign placeholder rather than an attempt to hide malicious commands.
Audit Metadata