telnyx-voice-gather-javascript
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted input from phone callers via DTMF digits and speech recognition using AI assistants. This creates an indirect prompt injection surface where a caller could potentially attempt to manipulate the AI's logic or downstream actions.
- Ingestion points: Caller input received through webhooks (call.gather.ended, call.ai_gather.ended) and processed by AI assistants in SKILL.md.
- Boundary markers: None explicitly implemented in the provided JavaScript examples to delimit user-provided speech from system instructions.
- Capability inventory: The skill allows the agent to send messages (client.messages.send) and control call actions (client.calls.actions.*) based on processed input.
- Sanitization: No input validation or sanitization logic is shown in the SDK usage examples.
Audit Metadata