vobiz-voice-calls
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a documentation guide and interface for the Vobiz Voice API (api.vobiz.ai). All network requests described target the vendor's own domain.
- [DATA_EXPOSURE]: The skill references
{auth_id}andcall_uuidplaceholders within API paths. These are standard parameters for RESTful API interactions and do not involve the use of hardcoded credentials or exposure of sensitive local files. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent processes VobizXML from an external
answer_url. This creates a potential surface for indirect prompt injection via the ingested XML content. - Ingestion points: External data enters the agent context via the
answer_urlHTTPS endpoint (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or warnings to isolate the external XML content from the agent's core instructions.
- Capability inventory: The skill uses API-based network operations (POST, GET, DELETE) to control telephony state but does not include local shell execution, file system writes, or eval-style dynamic code execution.
- Sanitization: There is no mention of sanitization or schema validation for the incoming VobizXML data.
Audit Metadata