create-campaign
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external contact data from CSV files and API responses, which constitutes an indirect prompt injection surface. This is addressed through robust operational safety rules.
- Ingestion points: User-supplied
customersarrays and CSV contact lists defined inSKILL.mdandreferences/api-reference.md. - Boundary markers: The skill includes specific instructions to redact sensitive PII and provide only counts or redacted samples during confirmation steps.
- Capability inventory: The agent can perform network operations via
curlto manage campaigns and calls. - Sanitization: The instructions require the agent to verify all live payloads against official schemas and explicitly check consent requirements.
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the Vapi REST API. These operations are directed at the vendor's official domain (api.vapi.ai) and are appropriate for the skill's defined purpose.
Audit Metadata