telnyx-voice-gather-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from phone callers (voice and DTMF) through AI-powered gather and assistant functions.
- Ingestion points: Caller speech and DTMF signals are sent to the AI assistant via
gatherUsingAIandstartAIAssistantcommands inSKILL.md. - Boundary markers: The instructions do not provide explicit delimiters or "ignore embedded instructions" warnings to separate caller input from the system's operational logic.
- Capability inventory: The skill is authorized to perform call control actions (e.g., adding messages, starting/stopping AI assistants) via the Telnyx SDK. No evidence of arbitrary command execution or non-vendor network access is present.
- Sanitization: The skill relies on the vendor's underlying AI service to interpret input; no explicit client-side sanitization or validation of the caller's speech content is shown in the examples.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the official Telnyx Node.js SDK from the public npm registry.
- Evidence:
npm install telnyx@6.74.2inSKILL.md.
Audit Metadata