Trust Assessment
telnyx-stt received a trust score of 64/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Potential data exfiltration: file read + network send, Arbitrary file read and exfiltration to third-party API.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential data exfiltration: file read + network send Function 'transcribe' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers. | Static | skills/dotcom-squad/telnyx-stt/scripts/telnyx-stt.py:23 | |
| HIGH | Arbitrary file read and exfiltration to third-party API The skill's primary function is to read an audio file specified by `audio_path` (a command-line argument) and upload its content to the Telnyx Speech-to-Text API. If an attacker can manipulate the host LLM to provide a path to a sensitive file (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, `/app/secrets.txt`) instead of an audio file, the skill will read the content of that sensitive file and exfiltrate it to the Telnyx API endpoint. The `os.path.exists` check only verifies file presence, not its suitability or sensitivity. Implement stricter validation or sandboxing for `audio_path`. This could include: 1. **Path Validation:** Restrict `audio_path` to a specific, isolated directory (e.g., a temporary upload directory managed by the LLM's environment) and prevent path traversal (`../`). 2. **Content Type Validation:** Before reading the file, verify its content type using a more robust method (e.g., `python-magic`) to ensure it is indeed an audio file. 3. **Execution Environment Sandboxing:** Ensure the skill runs in an environment with minimal file system permissions, only allowing access to necessary temporary directories. 4. **LLM Guardrails:** Implement strong guardrails in the LLM's prompt engineering to prevent it from generating calls with sensitive file paths. | LLM | scripts/telnyx-stt.py:20 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/dotcom-squad/telnyx-stt/scripts/telnyx-stt.py:11 |
Scan History
Embed Code
[](https://skillshield.io/report/1e4a229e7aafd0c2)
Powered by SkillShield