twilio-voice-conversation-relay
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes
voicePromptdata, which contains ASR-transcribed speech from external callers. This untrusted data is intended to be passed to an LLM, creating a surface for indirect prompt injection. - Ingestion points:
SKILL.mdcontains code examples (Python and Node.js) that extractvoicePromptfrom incoming WebSocket messages. - Boundary markers: While the code examples do not include boundary markers, the documentation includes a 'Security' advisory explicitly warning developers to isolate this input within a structured system prompt.
- Capability inventory: The skill facilitates bidirectional audio and LLM integration. Exploitation could lead to the LLM disclosing system instructions or speaking unintended content to the caller.
- Sanitization: The provided code snippets do not perform sanitization; however, the documentation advises implementing topic boundaries and output filtering.
Audit Metadata