ClawHub
Back to skill

Security audit

Bland

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Bland AI phone-calling tool, but it should be reviewed because it can spend money, handle call recordings/transcripts, configure live inbound agents, and use a broadly scoped API key file.

Before installing, confirm you want this skill to use your Bland AI account for real calls and billable account actions. Provide only a Bland API key intended for this skill, avoid relying on a shared /root/clawd/.env secret, and treat transcripts and recording URLs as sensitive data that may be exposed in terminal output or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Content
DEFAULT_VOICE="josh"
DEFAULT_MODEL="base"

# Load API key from environment or .env file
if [[ -z "${BLAND_API_KEY:-}" ]]; then
  ENV_FILE="${BASH_SOURCE[0]%/*}/../../../.env"
  if [[ -f "$ENV_FILE" ]]; then
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Load API key from environment or .env file
if [[ -z "${BLAND_API_KEY:-}" ]]; then
  ENV_FILE="${BASH_SOURCE[0]%/*}/../../../.env"
  if [[ -f "$ENV_FILE" ]]; then
    BLAND_API_KEY=$(grep '^BLAND_API_KEY=' "$ENV_FILE" | cut -d= -f2-)
  fi
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
if [[ -f "$ENV_FILE" ]]; then
    BLAND_API_KEY=$(grep '^BLAND_API_KEY=' "$ENV_FILE" | cut -d= -f2-)
  fi
  # Also try /root/clawd/.env directly
  if [[ -z "${BLAND_API_KEY:-}" ]] && [[ -f /root/clawd/.env ]]; then
    BLAND_API_KEY=$(grep '^BLAND_API_KEY=' /root/clawd/.env | cut -d= -f2-)
  fi
Confidence
88% confidence
Finding
The script falls back to reading a hardcoded secret file at /root/clawd/.env, which reaches outside the script's local configuration boundary and into a privileged account's credentials. In a shared agent or multi-skill environment, this can cause unintended credential reuse and grants the script access to secrets the operator did not explicitly provide for this tool.

Credential Access

High
Category
Privilege Escalation
Content
BLAND_API_KEY=$(grep '^BLAND_API_KEY=' "$ENV_FILE" | cut -d= -f2-)
  fi
  # Also try /root/clawd/.env directly
  if [[ -z "${BLAND_API_KEY:-}" ]] && [[ -f /root/clawd/.env ]]; then
    BLAND_API_KEY=$(grep '^BLAND_API_KEY=' /root/clawd/.env | cut -d= -f2-)
  fi
fi
Confidence
90% confidence
Finding
Checking for the existence of /root/clawd/.env indicates this script is designed to look for credentials in a privileged global location rather than only user-scoped config. That behavior increases the blast radius of the tool and can enable unauthorized use of another service account's API key when run in an environment where that file exists.

Credential Access

High
Category
Privilege Escalation
Content
fi
  # Also try /root/clawd/.env directly
  if [[ -z "${BLAND_API_KEY:-}" ]] && [[ -f /root/clawd/.env ]]; then
    BLAND_API_KEY=$(grep '^BLAND_API_KEY=' /root/clawd/.env | cut -d= -f2-)
  fi
fi
Confidence
92% confidence
Finding
This line actively reads BLAND_API_KEY from /root/clawd/.env, which is sensitive because it programmatically consumes a root-owned secret without explicit user consent. In the context of an agent skill, this is more dangerous than a normal CLI because it may silently appropriate platform-level credentials and then use them to place calls, fetch transcripts, or access billing data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly enables outbound AI calling plus access to transcripts and recordings, but the documentation does not warn about consent, privacy, or legal restrictions. In a voice-calling context, missing guardrails can lead users to capture or disclose personal information unlawfully or place calls in ways that violate policy or local law.

External Transmission

Medium
Category
Data Exfiltration
Content
NC='\033[0m'

# ── Config ──────────────────────────────────────────────────────────────────
API_BASE="https://api.bland.ai/v1"
DEFAULT_VOICE="josh"
DEFAULT_MODEL="base"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
NC='\033[0m'

# ── Config ──────────────────────────────────────────────────────────────────
API_BASE="https://api.bland.ai/v1"
DEFAULT_VOICE="josh"
DEFAULT_MODEL="base"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
api_post() {
  local endpoint="$1"
  local data="${2:-{\}}"
  curl -sS -f "${API_BASE}${endpoint}" \
    -X POST \
    -H "authorization: ${BLAND_API_KEY}" \
    -H "Content-Type: application/json" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script places outbound calls by sending the target phone number and user-supplied task content to the Bland AI API, but it only prints a status message that a call is being made. There is no explicit disclosure that user-provided content and call metadata are being transmitted to a third-party service.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The recording command requests recording metadata from the API and prints the recording URL directly to the console. This exposes access details for potentially sensitive audio without any explicit warning about privacy implications or handling of the returned link.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The transcript command retrieves call transcript data from the API and outputs the conversation contents directly to stdout. While the command name suggests transcript access, the file provides no user warning about exposure of sensitive spoken content in terminal output or remote retrieval from the provider.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documented commands can purchase phone numbers and configure live inbound agents, which have direct account and real-world effects, yet the skill provides no caution about charges, service activation, or interacting with real callers. This increases the chance of accidental spend, misconfiguration, or unintended deployment of an autonomous phone agent.

Static analysis

No suspicious patterns detected.