telnyx-video-javascript
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
telnyxpackage via npm. This is the official SDK provided by the vendor (team-telnyx) for interacting with their services.- [CREDENTIALS_UNSAFE]: The documentation includes a hardcoded example of a refresh token in therefreshClientTokensection. This is an expired JWT (exp: 1590010143) used solely for illustrative purposes in the SDK documentation.- [PROMPT_INJECTION]: The skill provides functions to retrieve dynamic content from external APIs, such as room participant lists and room recordings. This establishes a surface for indirect prompt injection. - Ingestion points: Data enters the context through methods like
client.roomParticipants.list()andclient.rooms.sessions.retrieve()inSKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the documentation.
- Capability inventory: The skill includes state-changing capabilities such as
client.rooms.delete(),client.rooms.sessions.actions.kick(), andclient.rooms.sessions.actions.mute()inSKILL.md. - Sanitization: No explicit sanitization or validation of the API-returned data is shown in the examples.
Audit Metadata