telnyx-voice-gather-go
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from phone callers, which constitutes a surface for indirect prompt injection.\n
- Ingestion points: Data is received via webhooks, including
data.payload.digitsanddata.payload.message_history(SKILL.md).\n - Boundary markers: There are no explicit delimiters or isolation instructions for user-supplied input in the provided examples.\n
- Capability inventory: The skill can perform actions such as
StartAIAssistantandGatherUsingSpeak, which use processed data to interact with the caller.\n - Sanitization: The examples do not show sanitization of caller input before it is used in conversation history or command parameters.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of an external library from the vendor's repository.\n
- Evidence:
go get github.com/team-telnyx/telnyx-goin SKILL.md.
Audit Metadata