T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
README.md:121- Finding
Full-Access API Key Recommended Despite Sensitive and Destructive Capabilities
- Content
View full analysis
- Remediation
View remediation
Security audit
AnveVoice
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for managing AnveVoice, but it exposes sensitive visitor data and destructive account actions while recommending overbroad API access.
Review this skill before installing. Use a narrowly scoped AnveVoice key, avoid Full Access unless you truly need administration, do not print or paste the API key, and require confirmation before accessing recordings, visitor profiles, leads, billing, or deleting/revoking account resources. Website operators should add privacy notices, consent flows, retention controls, and browser security controls for the remote embed script.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:258- Finding
Troubleshooting Instructions Expose the API Key in Terminal and Agent Output
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Warning
- Location
examples/create-bot.md:55- Finding
Mutable Remote JavaScript Executes in Visitor Browsers Without Integrity Pinning
- Content
View full analysis
``` Related unpinned widget examples appear in `README.md:233-280`: ```html ``` ### Technical Analysis The deployment instructions cause visitor browsers to download and execute JavaScript from third-party or service-controlled origins. The `voice-assistant-embed-js` edge-function URL and `anvevoice.com/embed.js` are mutable remote resources. No immutable content identifier, Subresource Integrity hash, or restrictive Content Security Policy guidance is provided. Remote widget execution is necessary for the declared hosted voice-assistant functionality. However, the current design means the effective browser-side payload can change after the Skill package has been reviewed. A compromise of the remote origin, deployment credentials, CDN pipeline, DNS configuration, or service account could consequently distribute modified code to every embedding website. Because the script executes in the embedding page's browser context, its effective access depends on page architecture and browser security controls. It may interact with page content and visitor input and participates in a workflow that requests microphone access and transmits voice data. ### Attack Path 1. A website owner copies the documented embed code into a production website. 2. Visitors load the website, causing their browsers to retrieve JavaScript from the documented externa ...[truncated 1461 chars]- Remediation
View remediation
``` - Publish signed release manifests and document how customers can verify asset hashes. - Isolate the voice widget inside a cross-origin sandboxed iframe with only the minimum required sandbox and Permissions Policy capabilities. - Provide a restrictive Content Security Policy example that limits `script-src`, `connect-src`, `frame-src`, and media destinations to documented origins. - Apply a restrictive Permissions Policy for microphone access and request access only after an explicit visitor action. - Pin third-party dependency versions and integrity hashes instead of relying only on URL versioning. - Maintain a controlled release and rollback process for widget updates. - Monitor widget assets for unauthorized changes and alert on unexpected hash modifications. - Clearly document all network destinations and data types transmitted by the widget. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
Output:
html <!-- AnveVoice Embed Code --> <script src="https://anvevoice.com/embed.js" data-bot-id="YOUR_BOT_ID" data-position="bottom-right"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
-
Never commit keys to git:
bash echo ".env" >> .gitignore -
Use minimal scope keys:
-
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes sensitive capabilities such as session recordings, visitor intelligence, lead extraction, and full-site crawling, but it does not clearly warn operators about consent, notice, retention, or regulatory obligations. This can lead users to deploy privacy-impacting features without implementing disclosures or controls, increasing the risk of unlawful data collection and mishandling of visitor information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to embed a remote third-party script from anvevoice.com directly into their website without warning that this executes externally hosted code in visitors' browsers and may transmit audio, behavioral, and conversation data to the service. Because the script is remotely controlled by the vendor, any compromise, malicious update, or unexpected data collection would affect every site that installs it.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 60% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
md **Fix:** 1. Verify key starts with `anvk_` 2. Check key is complete (no truncation) 3. Generate a new key at anvevoice.com/developer 4. Ensure no extra spaces in the key </details>
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The recommended query examples are broad business phrases like support, engagement, accessibility, and sales automation that can overlap with ordinary user intent in many contexts. This increases the chance of unintended invocation of a skill that can access customer conversations, leads, analytics, and other sensitive operational data, causing over-broad capability exposure without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auto-trigger list uses ambiguous phrases such as 'voice AI' and 'voice support' without any contextual qualifiers or exclusion rules. In an agent ecosystem, this can cause the skill to activate for unrelated conversations and then expose tools for recordings, visitor intelligence, and lead extraction that the user did not explicitly request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises access to recordings, visitor profiles, conversation search, extracted leads, billing, and global analytics, but it does not prominently warn that these are privacy-sensitive and potentially regulated data categories. This creates a real risk of users invoking surveillance-style or bulk data access features without understanding the sensitivity, retention, consent, and legal implications, especially in healthcare, education, and customer-support contexts.
- Content
Static analysis
No suspicious patterns detected.