telnyx-webrtc-go
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill provides functionality to fetch data from the Telnyx API, creating a surface for indirect prompt injection if API fields contain malicious instructions.\n
- Ingestion points: The
MobilePushCredentials.List,MobilePushCredentials.Get,TelephonyCredentials.List, andTelephonyCredentials.Getmethods inSKILL.mdretrieve external data from the Telnyx platform.\n - Boundary markers: The provided code examples do not implement boundary markers or instructions to ignore embedded commands within the API response data.\n
- Capability inventory: The skill utilizes the
github.com/team-telnyx/telnyx-golibrary to perform network operations against the Telnyx API.\n - Sanitization: No sanitization or structural validation is performed on the data retrieved from the API before it is output using
fmt.Printf, which could allow malicious content in fields like credential aliases to influence the agent.\n- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install a package from a remote repository.\n - Evidence: The command
go get github.com/team-telnyx/telnyx-goinSKILL.mdfetches the SDK from GitHub.\n - Note: The source repository is the official SDK for the vendor (
team-telnyx), representing a standard and legitimate dependency.
Audit Metadata