create-structured-output
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill explicitly mandates that the
VAPI_API_KEYmust be read from environment variables and strictly forbids printing, requesting, or embedding the key in source code or chat logs. It further emphasizes treating call transcripts and extracted values as sensitive customer data with minimal logging. - [EXTERNAL_DOWNLOADS]: The skill references official and well-known vendor resources, including
api.vapi.ai,docs.vapi.ai, and official Vapi SDK repositories on GitHub. These are trusted sources for the intended functionality. - [COMMAND_EXECUTION]: The provided
curlexamples are standard REST API interactions targeting the official vendor domain. The instructions include security practices like using--fail-with-bodyand verifying resource IDs before execution to prevent accidental data corruption or unauthorized access. - [PROMPT_INJECTION]: The skill uses structured JSON schemas and type-specific extraction ('ai' vs 'regex') to define strict output contracts. This design limits the ability of untrusted transcript data to influence the AI's behavior beyond the intended extraction parameters.
Audit Metadata