ClawHub
Back to skill

Security audit

phone calling

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant for real phone calls, but it gives an AI broad calling and call-data powers without enough confirmation, consent, and scope controls.

Review carefully before installing. Use it only for calls the user explicitly requested, require a clear confirmation showing the destination number, mode, and possible cost before each call, keep direct and bulk calling disabled unless deliberately approved, do not send PINs, passwords, OTPs, or banking secrets through DTMF, and enable transcription, recording, sentiment analysis, or webhooks only after confirming participant consent and retention rules. Protect session/API keys and prefer pinned, verified SDK versions or the scoped REST API.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Unauthenticated Email Account Enumeration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-40
Vulnerability Type: Account enumeration through distinguishable authentication responses
Risk Level: Medium

Vulnerable Code

http
POST https://ringez-api.vercel.app/api/v1/auth/check-email
Content-Type: application/json

{"email": "you@example.com"}

Response:

  • new_user → Continue to OTP verification
  • existing_user → Login with password

Technical Analysis

The documented unauthenticated endpoint accepts an arbitrary email address and explicitly reveals whether the address belongs to a new or existing user. This creates an account-enumeration oracle.

Authentication systems should normally return a uniform response regardless of whether an account exists. The registration status is not required to be disclosed to an unauthenticated client; the server can internally select the appropriate authentication flow while presenting the same external response.

The canonical API definition in openapi.json:17-52 confirms that the endpoint returns a user_status value whose possible values are new_user and existing_user.

Attack Path

  1. An attacker obtains or generates a list of potential victim email addresses.
  2. The attacker submits each address to /api/v1/auth/check-email.
  3. The attacker classifies addresses according to the new_user or existing_user response.
  4. Confirmed Ringez users are selected for credential stuffing, password spraying, targeted phishing, or OTP abuse.
  5. If rate limiting and abuse controls are absent or insufficient, this process can be automated at scale.

Impact Assessment

The endpoint does not directly grant account privileges, but it discloses private account-registration state to unauthenticated callers. This improves the accuracy and efficiency of subsequent attacks against registered users.

The affected scope includes any email address that can be queried against the servi ...[truncated 128 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the distinguishable responses with a uniform message such as: “If this address is eligible, further instructions will be sent.”
  2. Internally determine whether login, registration, or OTP processing is appropriate without returning account-existence state.
  3. Apply per-IP, per-email, and device-level rate limits.
  4. Add progressive delays, anomaly detection, and temporary suppression for repeated enumeration patterns.
  5. Avoid response-time differences that could recreate the enumeration oracle as a timing side channel.
  6. Log suspected enumeration attempts without recording unnecessary plaintext personal data.
  7. Document generic error responses in both SKILL.md and openapi.json.

T08 · Insecure Dependencies

Warning
Location
ringez-quickstart-guide.md:40
Finding

Unpinned Third-Party SDK Installation Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: ringez-quickstart-guide.md:40-50
Vulnerability Type: Unversioned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install ringez-sdk
bash
npm install @ringez/sdk
text
### Direct REST API
No installation needed - just use `curl` or your HTTP client.

Equivalent unpinned installation instructions also appear in ringez-implementation-guide.md:57-62,186-191 and ringez-api-spec.md:1061-1066, including:

bash
go get github.com/ringez/go-sdk

Technical Analysis

These commands resolve mutable package versions at installation time. The project does not provide reviewed version pins, cryptographic hashes, lockfiles, checksums, signatures, or package-publisher verification instructions.

Package installation and later package import can execute dependency-controlled code with the privileges of the developer, CI worker, container build, or production service. The audit did not establish that the referenced packages are currently malicious; the vulnerability is that the instructions trust whichever package version the registry or repository resolves in the future.

Attack Path

  1. A developer or agent follows the documented installation command.
  2. The package manager resolves the latest available SDK and its transitive dependencies.
  3. An attacker compromises a publisher account, package registry, source repository, or transitive dependency—or publishes a malicious replacement where namespace ownership is not securely established.
  4. The malicious artifact runs during installation, build, import, or application startup.
  5. It accesses privileges available to that environment, potentially including RINGEZ_API_KEY, webhook secrets, source code, CI tokens, filesystem data, and network connectivity.
  6. The compromised package can exfiltrate credentials or alter call destinations and AP ...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every SDK to a reviewed exact version rather than installing an unconstrained latest release.
  2. For Python, publish a hash-locked requirements file and install with pip --require-hashes.
  3. For Node.js, provide and enforce a reviewed lockfile using npm ci; verify package scope and publisher ownership.
  4. Pin Go dependencies to a reviewed version or commit and retain checksum verification.
  5. Publish official checksums or signed provenance attestations for released SDK artifacts.
  6. Audit all transitive dependencies and enable automated dependency monitoring.
  7. Run installation and applications in least-privilege containers without unrelated credentials or host filesystem access.
  8. Prefer the documented direct REST interface when SDK provenance cannot be independently verified.

T09 · Insecure Skill Coding Practices

Error
Location
ringez-quickstart-guide.md:66
Finding

Privacy-Unsafe Transcription Defaults Expose Call Content to Remote Processing

Content
View full analysis

Vulnerability Details

File Location: ringez-quickstart-guide.md:66-88
Vulnerability Type: Excessive collection and network transmission of sensitive conversation data
Risk Level: High

Vulnerable Code

python
from ringez import RingezClient
import os

# Initialize client
client = RingezClient(api_key=os.getenv('RINGEZ_API_KEY'))

# Create a session
session = client.sessions.create({
    "session_type": "authenticated",
    "user_consent": {
        "calling_authorized": True,
        "privacy_mode": False
    }
})

print(f"Session created: {session.id}")
print(f"Balance: {session.wallet_balance.minutes} minutes")

# Make a call
call = client.calls.initiate({
    "session_id": session.id,
    "to_number": "+14155551234",  # Replace with actual number
    "from_number": "+12025551000",
    "call_settings": {
        "transcribe": True,
        "max_duration": 300
    }
})

The guide subsequently sends transcript content for additional server-side analysis in ringez-quickstart-guide.md:274-280:

python
async def analyze_transcript(text):
    # Detect intent
    intent = client.agents.detect_intent({
        "transcript_segment": text
    })

Similar transcription-enabled examples appear in ringez-implementation-guide.md:69-100,198-221,248-282 and ringez-api-spec.md:186-199,474-522,580-598.

Technical Analysis

The introductory calling example explicitly disables privacy mode while enabling transcription. Transcription is not required for the Skill’s minimum declared function of placing an international call.

Call audio may contain passwords, payment information, medical information, account identifiers, personal addresses, private conversations, or confidential business information. Enabling transcription sends this content to remote processing infrastructure. Passing transcript segments to intent or sentiment endpoints creates an additi ...[truncated 1731 chars]

Remediation
View remediation

Remediation Suggestions

  1. Set privacy_mode to True and transcribe to False in all introductory and default examples.
  2. Require an explicit, purpose-specific opt-in before enabling transcription.
  3. Obtain and document consent from every participant where required; provide an audible notice before processing starts.
  4. Keep transcription separate from ordinary call authorization so consent to a call cannot implicitly authorize recording or analysis.
  5. Minimize transcript transmission and avoid sending complete transcript segments when a locally derived, non-sensitive intent is sufficient.
  6. Apply automated redaction for passwords, OTPs, payment data, health information, and other sensitive identifiers before secondary analysis.
  7. Define retention periods, encryption requirements, access controls, deletion endpoints, and audit logging for audio and transcripts.
  8. Do not expose transcript or recording URLs without short-lived, narrowly scoped authorization.
  9. Prevent transcript content from being written to ordinary application logs.
  10. Provide a local-processing option for deployments that cannot permit remote transcript analysis.
  11. Clearly document the service providers, storage regions, subprocessors, and applicable recording or wiretap-law requirements.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The call initiation action triggers a real-world external phone call and may consume paid or limited minutes, but the operation description does not require an explicit user confirmation or warning about charges and external effects. In an agent context, this creates a high-risk side effect: ambiguous prompts, prompt injection, or misunderstanding could cause unwanted calls, financial loss, or harassment of third parties.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The overview claims autonomous calling can occur 'without requiring authentication,' while the specification elsewhere requires bearer-token authentication. Contradictory security claims create dangerous ambiguity: implementers may omit authentication checks, assume guest flows are unauthenticated, or expose endpoints incorrectly, leading to unauthorized call placement or account abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The spec promotes autonomous outbound calling and includes recording/transcription capabilities without prominent warnings about consent, privacy law, call recording legality, or third-party data handling. In a phone-calling skill, this omission is especially dangerous because the core function directly affects external people and may capture highly sensitive audio and transcripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide promotes real-time transcription and transcript analysis without prominent warnings about consent, privacy, or jurisdiction-specific recording laws. In a phone-calling context, this omission can lead developers to deploy unlawful or unethical call monitoring that captures sensitive information without proper notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The sales outreach batch-calling example enables automated bulk outbound calling without any warning about consent, anti-spam, robocalling, or telemarketing compliance requirements. In this context, the omission can facilitate abusive campaigns and significant legal or reputational harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly supports initiating outbound calls, including unattended direct-mode calls by AI agents, but does not prominently require user confirmation, disclose potential per-minute charges at call time, or warn about consent and legal restrictions around automated calling. In this context, the capability is inherently sensitive because it can trigger real-world actions, costs, and privacy/compliance issues if an agent places calls without clear user authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The DTMF section encourages sending digits such as a PIN over a live phone call without warning that this may expose sensitive credentials to the called party, intermediaries, recordings, or an agent handling the interaction. In a calling skill, this is especially risky because DTMF is commonly used for authentication and financial/account access, so normalizing PIN entry can facilitate credential disclosure or unauthorized account actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The /auth/check-email endpoint explicitly reveals whether an email is registered by returning 'new_user' or 'existing_user'. That enables account enumeration, which can be abused for user discovery, targeted phishing, credential-stuffing prioritization, and privacy leakage about service membership. In a consumer phone-calling service, knowing who has an account can be operationally useful to attackers and is not necessary to expose to unauthenticated callers in this form.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The call termination endpoint performs an irreversible disruptive action by hanging up an ongoing call, but the API description does not surface an explicit warning or confirmation requirement. In an agent-driven environment, a mistaken or manipulated invocation could prematurely terminate legitimate calls, causing denial of service, user disruption, and possible financial or business impact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest advertises payment with PayPal or UPI, but the wallet API also supports Stripe/Cashfree and the broader spec includes unrelated operational features. This mismatch undermines informed consent and can cause users or host platforms to authorize a skill with a much broader operational and payment surface than disclosed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill metadata says it is for international phone calls and payment, but the spec also exposes persistent contact management features. This expands the skill's effective data access and retention surface beyond the user-declared purpose, increasing privacy and misuse risk through unnecessary collection and storage of personal contact data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Persistent address-book management is not necessary to place a one-off international call and creates a store of third-party personal data. That increases privacy, compliance, and abuse risk if the agent can add, list, update, or delete contacts beyond the minimal call workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The spec adds transcription, transcript retrieval, sentiment analysis, intent detection, and voice synthesis even though the skill is described only as phone calling. These features materially increase surveillance, profiling, and content-generation capability, especially because they can process sensitive call content and create derived data without clear disclosure in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

AI analysis and generation endpoints such as sentiment analysis, intent detection, and voice synthesis are not required to make calls and substantially broaden the capability surface. They enable profiling of call participants and generation of synthetic voice content, which can facilitate impersonation, manipulation, or undisclosed automated interactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ringez-api-spec.md (reported line 836)May include surrounding context.

md
def make_support_call(self, customer_number, issue_description):
        # Create session
        session = requests.post(
            f"{self.base_url}/sessions/create",
            headers=self.headers,
            json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ringez-api-spec.md (reported line 849)May include surrounding context.

md
).json()
        
        # Initiate call
        call = requests.post(
            f"{self.base_url}/calls/initiate",
            headers=self.headers,
            json={

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Batch, scheduled, and queued calling features can scale or delay outbound calls in ways that amplify abuse, spam, harassment, or accidental mass-calling. The lack of explicit warnings and safeguards is risky in context because the skill already supports autonomous calling and could be integrated into agents with limited human oversight.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example retrieves and prints call transcripts without any explicit notice that call content is privacy-sensitive or that consent, disclosure, retention, and access controls are required. In a phone-calling skill, transcription can capture highly sensitive personal or financial data, so normalizing transcript access without safeguards increases the risk of unlawful recording, over-collection, and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section combines real-time transcription with AI intent analysis and automated actions, but does not warn that continuous speech processing may handle sensitive personal data and trigger consequential decisions. In the context of autonomous call handling, this can enable opaque surveillance, profiling, or inappropriate automated transfers/responses without adequate consent or human review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide advertises and demonstrates capabilities far beyond the manifest's stated purpose of simple international phone calling, including transcription, analytics, routing, and AI analysis. This scope expansion increases the chance that an agent or user enables sensitive data collection and autonomous call handling they did not expect from the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example code directly places outbound calls and later adds wallet credits, but the guide does not clearly warn that running these examples can contact real phone numbers and incur charges. This can cause accidental calling, billing loss, and misuse if copied verbatim into agent workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ringez-quickstart-guide.md (reported line 165)May include surrounding context.

makeFirstCall();

text

### cURL Example

```bash
# Create session

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The transcription examples hard-code the language to "en-US", and the appointment reminder example also hard-codes an English voice, without indicating that this is configurable or limited to a justified region-specific use case. This is a natural-language locale policy issue because the guide implicitly defaults users to a specific language without opt-in or explanation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Transcript analysis and sentiment/intent detection process call content, which can include sensitive personal or confidential information, yet these features are not justified by the skill's narrow stated purpose. In a phone-calling skill context, hidden or under-disclosed conversation analysis materially raises privacy, compliance, and surveillance risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Automated call routing and transfer allow the agent to change live call destinations without clear disclosure or scope justification. That can redirect users to unintended recipients, escalate social-engineering risk, and create operational or billing consequences beyond merely placing a call.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.